Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys (CVE-2026-48806) | HOL Guard CVE