Symfony: Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address (CVE-2026-45068) | HOL Guard CVE