symfony/ux-icons: XSS via unsanitized SVG content in local files and Iconify on-demand responses (CVE-2026-55877) | HOL Guard CVE