HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory (CVE-2026-55471) | HOL Guard CVE