shell-quote parse() is quadratic in token count, enabling denial of service (CVE-2026-13311) | HOL Guard CVE