Kirby: `pages.access` permission is not checked in the pages picker for parent pages (CVE-2026-49274) | HOL Guard CVE