bug: Tenant-to-host escape risk via vm.runInNewContext in custom JWT scripts

### Describe the bug According to the official Node.js documentation, the `vm` module (including `vm.runInNewContext`) is not a security mechanism and should not be used to run untrusted code. In a multi-tenant SaaS environment (Logto Cloud), allowing tenant administrators to execute custom JWT scripts via `vm.runInNewContext` introduces a severe tenant-to-host escape risk. A malicious tenant admin can use prototype chain pollution or constructor escaping (e.g., `this.constructor.constructor('return process')()`) to break out of the VM context, read host environment variables (including database credentials and master keys), or execute arbitrary system commands. ### Expected behavior To securely execute tenant-provided scripts, Logto should migrate to a true isolation mechanism. Recommended alternatives include: 1. `isolated-vm` (V8-level isolation). 2. WebAssembly (Wasm) based script engines. 3. Container-level isolation for the script execution worker nodes in the Cloud environment. ### How to reproduce? 1. Locate the custom JWT script execution logic where vm.runInNewContext is invoked. 2. As a tenant admin, input the following malicious script payload into the custom JWT configuration: ``` const process = this.constructor.constructor('return process')(); const env = process.env; // The attacker can now read host environment variables or execute commands ``` 3. Trigger the script execution and observe that the host environment is accessible, proving the sandbox escape. ### Environment Logto Cloud ### Screenshots _No response_