protobufjs-cli: Code injection in pbjs static output from crafted JSON descriptor names (CVE-2026-54271) | HOL Guard CVE