graphql-php is affected by a Denial of Service via quadratic complexity in OverlappingFieldsCanBeMerged validation (CVE-2026-40476) | HOL Guard CVE