UrlShortener extension url validation can be bypassed due to difference between php url parsing and WHATWG (CVE-2026-13706) | HOL Guard CVE