SSRF bypass, sandbox escapes, unauthorized disk writes, session hijacking. Every security fix OpenClaw shipped in February 2026, explained in plain English.