Sigstore Timestamp Authority has OOM due to unbounded metric label cardinality (CVE-2026-49835) | HOL Guard CVE