sigstore's `certificateOIDs` verification constraints are silently dropped and never enforced (CVE-2026-48815) | HOL Guard CVE