linuxfabrik-lib: fetch() forwards credential headers across a cross-origin redirect (CVE-2026-67435) | HOL Guard CVE