GuardDog has a blind GitHub URL rewrite in remote project scanning causes SSRF and `GH_TOKEN` exfiltration (CVE-2026-44971) | HOL Guard CVE