Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filters (CVE-2026-48807) | HOL Guard CVE