MessagePack-CSharp: Multi-dimensional array formatters allocate from unchecked dimensions (CVE-2026-48515) | HOL Guard CVE