vLLM: ReDoS via structured_outputs.regex compiled without timeout in xgrammar and outlines backends (CVE-2026-55574) | HOL Guard CVE