UltraJSON: Malformed/Truncated UTF-8 Accepted and Silently Rewritten in ujson.dumps() (CVE-2026-54911) | HOL Guard CVE