antlr ANTLR4 Maven Plugin GrammarDependencies.java ObjectInputStream.readObject toctou (CVE-2026-13502) | HOL Guard CVE