symfony/ux-live-component: XSS via attacker-controlled child component tag (CVE-2026-49210) | HOL Guard CVE