MessagePack-CSharp: LZ4 decompression allocates from unbounded declared output lengths (CVE-2026-48510) | HOL Guard CVE