Chainguard Zero-CVE Images vs Safety Firewall (2026)