CVE-2026-33252: Cross-Site Request Forgery in ModelContextProtocol Go SDK | NextGuard