Algernon: Auto-refresh SSE event server sets Access-Control-Allow-Origin: * (CVE-2026-46431) | HOL Guard CVE