Foreman: ssrf to cloud metada service through unvalidated test_url parameters in foreman config (CVE-2026-13316) | HOL Guard CVE