GHSA-rhp5-r9x4-f5g2: NLTK: Unsafe Pickle Deserialization in TransitionParser Allows Remote Code Execution

## Summary The NLTK library's `TransitionParser.parse()` method deserializes model files using `pickle_load()` with the default `restricted=False` parameter, allowing arbitrary Python code execution when loading a malicious model file. The library provides a `RestrictedUnpickler` class for safe deserialization, but it is never used by production code paths, leaving the vulnerability unpatched. …