Twig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation (CVE-2026-46640) | HOL Guard CVE