symfony/ux-live-component: LiveComponentHydrator HMAC checksum lacks component and slot binding (CVE-2026-49212) | HOL Guard CVE