Strawberry GraphQL's Bypass of MaxAliasesLimiter via Fragment Spreads leading to GraphQL Alias Amplification (CVE-2026-47707) | HOL Guard CVE