GHSA-m4rf-3fr8-xwx3: NLTK: JVM argument injection bypass via per-call options in the NLTK Stanford wrappers (incomplete fix of CVE-2026-12841)

NLTK's Stanford wrapper classes have a security vulnerability where the `java_options` parameter bypasses validation that was supposed to block dangerous JVM (Java Virtual Machine, the software that runs Java programs) flags like `-agentpath` and `-javaagent`. While a previous fix added validation through the `config_java()` function, the per-call `options` parameter in the `java()` function skips this validation entirely, allowing attackers to inject malicious JVM arguments and execute arbitrary code.