Grails `bindable` constraint not being respected

### Expected Behavior

We are using command objects with the `Validatable` interface. In the constraints block we are using `bindable: false` for some properties. The expected behavior is that these fields should be non-bindable by the front-end user when they access endpoints.

### Actual Behaviour

Instead, if the command object is either defined in a plugin, or not referenced in the argument list of an endpoint on a controller, the command object will be fully bindable even if bindable is set to false.

Why does a command object need to be referenced in a controller within the same project in order for bindable to be respected?

### Steps To Reproduce

1. Create a grails application and plugin
2. Define a command object using the bindable: false constraint on a property within the plugin
3. Create a controller in the main application with an endpoint that uses the command object from the plugin
4. Try to bind in data via the url for the new endpoint

I created an example application showing the issue with unit-tests that also show the issue. In the project the "ExampleController" class has further explanation if needed.

### Environment Information

Mac OS Monterey
Java 17.0.2-zulu
Groovy 3.0.11
Grails 5.2.5

### Example Application

https://github.com/joe-albert/grails-bindable-bug

### Version

5.2.5