sh _uid does not drop supplementary groups (incomplete privilege drop) (CVE-2026-54552) | HOL Guard CVE