@jshookmcp/jshook: ICMP probe and traceroute skip local-network SSRF authorization (CVE-2026-49856) | HOL Guard CVE