Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking (CVE-2026-55076) | HOL Guard CVE