OpenProject: Journal diff endpoint bypasses object, journal, and field visibility checks (CVE-2026-47193) | HOL Guard CVE