Formie: Pre-authenticated server-side template injection in Hidden fields

An unauthenticated attacker submits a crafted value into a Hidden field that has its Default value type set to "Custom" on a public Formie form. During submission handling, the `serializeValue()` method passes the attacker-supplied value through `Variables::getParsedValue()`, which evaluates it as Twig markup [patch_id=418988]. The attacker does not need a control panel login; only a publicly accessible form with at least one Hidden field configured with a Custom default value is required. The Twig evaluation occurs server-side, so the payload is executed in the context of the Craft template/sandbox environment, potentially leading to full site compromise.

The vulnerable code resides in `src/fields/formfields/Hidden.php` within the `serializeValue()` method. The method unconditionally passes the field value (which may be attacker-controlled) through `Variables::getParsedValue()`, causing Twig evaluation of arbitrary input [patch_id=418988].

The patch moves the `Variables::getParsedValue()` call so that it is only applied to the default value when no user-supplied value exists (i.e., when `$value === ''`). Previously, the code first assigned the default value, then unconditionally called `Variables::getParsedValue()` on whatever value was present — including attacker-supplied input. By guarding the Twig evaluation behind the empty-value check and removing the unconditional second call, the patch ensures that only the pre-configured default value is ever parsed as Twig, while user-submitted values are stored as plain text [patch_id=418988].