strawberry-graphql: Authentication bypass via legacy graphql-ws WebSocket subprotocol (CVE-2026-35523) | HOL Guard CVE