CVE-2026-77422: JLine: ReDoS in Built-in grep Command Amplified by Automatic `.*` Wrapping

The JLine3 built-in grep command wraps the user-supplied regular expression with .* before compiling it with Java’s backtracking regex engine. This amplifies catastrophic backtracking and allows a short pattern such as (a+)+b to hang the command thread on non-matching input. In environments that expose the JLine shell to remote users, this is a denial-of-service issue.