CVE-2026-5263 URI nameConstraints not enforced in ConfirmNameConstraints()