Apache Druid JavaScript RCE vulnerability (CVE-2021-25646) fix via @JacksonInject hardening and constructor validation.