Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing (CVE-2026-55438) | HOL Guard CVE