vm2 3.11.7 fixes six NodeVM sandbox escapes

vm2 3.11.7 patches six vulnerabilities that let untrusted JavaScript escape the NodeVM sandbox in Node.js. Two flaws depend on the runtime: CVE-2026-92944 requires Node.js 26, while CVE-2026-92948 needs Node.js 24 or newer.

• CVE-2026-92957: a -node:child_process builtin entry fails to block require('child_process')
• CVE-2026-92958: denying fs does not cover fs/promises, allowing host file writes
• CVE-2026-92941: sandbox can replace host default CA certificates via tls
• CVE-2026-92951: allowlist with left-pad accepts evil-left-pad due to inexact matching