Under the EU Cyber Resilience Act, open-source software stewards are classified as a separate legal category whose reporting obligations do not begin until December 11, 2027