vLLM fixes cross-request output constraint vulnerability caused by residual request state

When the vLLM V1 engine reuses batch slots, it can retain the allowed_token_ids mask from the previous request, causing subsequent requests to inherit output vocabulary constraints set by others, even when HTTP 200 is returned. This vulnerability affects cross-request output integrity and is vocabulary steering, not arbitrary text replacement; the advisory does not report confidentiality or availability impact. The GitHub advisory marks affected versions as < 0.31.0 and the fixed version as 0.31.0.