GHSA-vj8p-hp9x-gh47: mpp vulnerable to Gas Draining with low gas limit

## Vulnerability When the server acts as the fee payer, `mpp` Elixir 0.4.0 (ZenHive/mpp) does not validate whether the `gas_limit` set by the client is enough before broadcasting. A malicious client can drain the server's gas without paying. A `transferWithMemo` call on Tempo Moderato testnet requires **~51,299 gas** to complete successfully. By setting `gas_limit = 51,298`: 1. The Tx gets cosigned and broadcast by the server. 2. The Tx runs out of gas during EVM execution. All state reverts. 3. The server's fee-payer wallet is charged for gas used. 4. …