TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes (CVE-2026-55661) | HOL Guard CVE