CVE-2026-3276 Potential DoS via quadratic complexity in unicodedata.normalize()