Data-sciences-pipeline: dsp: v1 argo template path accepts arbitrary workflow spec, bypassing all v2 security hardening (CVE-2026-18621) | HOL Guard CVE