`jwt` (Ruby gem) - empty-key HMAC bypass (CVE-2026-45363) | HOL Guard CVE