py7zr: Decompression bomb (zip bomb) denial of service via unchecked extraction size (CVE-2026-55195) | HOL Guard CVE