Bluetooth: hci_sync: hold conn in hci_past_sync() callback (CVE-2026-74528) | HOL Guard CVE