Pimcore CMS Twig Sandbox Bypass via SecurityPolicy checkMethodAllowed (CVE-2026-11407) | HOL Guard CVE