tract: Arbitrary file read via unsanitized ONNX external_data `location` (path traversal) on model load in tract-onnx (CVE-2026-55832) | HOL Guard CVE