Gitea forwarded-proto handling allows public URL spoofing (CVE-2026-27779) | HOL Guard CVE