Faraday has a possible incomplete fix for GHSA-33mh-2634-fwr2: protocol-relative URI objects still bypass host scoping (CVE-2026-33637) | HOL Guard CVE