MessagePack-CSharp: ASP.NET Core MessagePackInputFormatter defaults to TrustedData for HTTP request bodies (CVE-2026-48509) | HOL Guard CVE