Twig: Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion points (CVE-2026-47732) | HOL Guard CVE