Armeria: External Control of File Name or Path in xDS SDS DataSource (CVE-2026-11752) | HOL Guard CVE