fast-uri vulnerable to host confusion via failed IDN canonicalization (CVE-2026-13676) | HOL Guard CVE