Host command execution via stacked call indirection

Sandbox escape in vm2 before 3.11.6 allows attackers to execute arbitrary host commands via crafted JavaScript run inside a vm2 sandbox. In lib/bridge.js and lib/setup-sandbox.js, the bridge peels only one layer of Function.prototype.call, apply, and bind indirection and can still expose dangerous host prototype getter and setter mutators, letting sandbox code sever a host object's prototype chain and pivot through e.constructor.constructor. Exposure requires an application to pass attacker-controlled code into vm2; once that code runs, the escape executes in the embedding Node.js process context rather than remaining confined to the sandbox.