MessagePack-CSharp: ExpandoObject formatter can perform quadratic insertion work on untrusted maps (CVE-2026-48511) | HOL Guard CVE