fix(security): setting object to OBJECT_TO_POPULATE for security expression

Author: weaverryan

src/Serializer/AbstractItemNormalizer.php

@@ -441,7 +441,7 @@ protected function canAccessAttribute(?object $object, string $attribute, array
         $security = $propertyMetadata->getSecurity();
         if (null !== $this->resourceAccessChecker && $security) {
             return $this->resourceAccessChecker->isGranted($context['resource_class'], $security, [
-                'object' => $object,
+                'object' => $object ?? $context[self::OBJECT_TO_POPULATE] ?? null,
             ]);
         }