Symfony: Email Header Injection via Non-Token Characters in Mime Parameter Names (CVE-2026-45070) | HOL Guard CVE