PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed (CVE-2026-48526) | HOL Guard CVE