OAuth2::Client#request: Protocol-relative redirect Location overrides authority, leaking bearer Authorization to attacker host (CVE-2026-54603) | HOL Guard CVE