Commercial cryptocurrency hardware wallets and downloadable wallet software are subject to the EU Cyber Resilience Act's 24-hour reporting mandate if they feature direct or indirect network data connections