hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`) (CVE-2026-54286) | HOL Guard CVE