CVE-2026-92957: vm2 NodeVM built-in module deny-list bypass

vm2 through version 3.11.6 does not normalize user-supplied negative built-in-module entries in NodeVM policies when they use the “node:” prefix. As a result, sandboxed code may obtain the host child_process module.