langchain-openai: Image token counting SSRF protection can be bypassed via DNS rebinding (CVE-2026-41488) | HOL Guard CVE