gonic: Path Traversal in playlist `id` bypasses ownership check, enabling any user to read/delete other users' playlists (CVE-2026-49339) | HOL Guard CVE