Gogs has an Authentication Bypass via Unvalidated Reverse Proxy Headers (CVE-2026-25119) | HOL Guard CVE