Algernon: Host header path traversal in --domain mode reads files and runs Lua from parent dir (CVE-2026-48126) | HOL Guard CVE