SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet() (CVE-2026-54067) | HOL Guard CVE