As CISA tells US govt agencies to squash Log4j bug by Dec 24, fingers start pointing at China, Iran, others