Why is BPDU guard an effective way to prevent an unauthorized rogue switch from altering the spanning-tree topology of a network?