Bugsink: Project scoping missing in sourcemap and debug-file lookup (CVE-2026-47728) | HOL Guard CVE