Mattermost doesn't filter nil elements from outgoing webhook attachment payloads before processing (CVE-2026-4915) | HOL Guard CVE