veraPDF-validatio: Use of Default `DocumentBuilderFactory` leads to XXE When Processing Untrusted PDFs (CVE-2026-54082) | HOL Guard CVE