Gitea has insufficient permission checks for Composer package source links (CVE-2026-27771) | HOL Guard CVE