@hey-api/openapi-ts's `buildClientParams` template: prototype chain substitution via unknown `$<slot>___proto__` key (CVE-2026-48819) | HOL Guard CVE