pgAdmin 4: OS command injection in MASTER_PASSWORD_HOOK via untrusted username substitution (CVE-2026-17347) | HOL Guard CVE