Apache Airflow exposes secret values to authenticated UI users via rendered templates (CVE-2025-66388) | HOL Guard CVE