fix: block RCE via module denylist in YAML config loader

[aimenhamzi01-dot]

Problem

The resolve_code_reference() function in config_agent_utils.py
uses importlib and getattr to resolve arbitrary Python objects
from YAML config, allowing RCE via dangerous modules like os.system.

Solution

• Add _BLOCKED_MODULES to block dangerous modules (os, sys,
  subprocess, etc.) in resolve_code_reference()
• Expand _BLOCKED_YAML_KEYS to cover all dynamic code fields
• Set _ENFORCE_DENYLIST = True globally

Testing

Verified that loading a YAML config with os.system as model_code
now raises ValueError instead of executing the command.

Security

This fix addresses an RCE vulnerability reported via Google OSS VRP
(Reference: 506632409)

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[rohityan]

Hi @aimenhamzi01-dot , Thank you for your contribution! We appreciate you taking the time to submit this pull request. Can you please fix the failing tests before we can proceed with the review.

[rohityan]

Hi @aimenhamzi01-dot , Thank you for your contribution! We appreciate you taking the time to submit this pull request. Can you please fix the failing tests before we can proceed with the review.

[aimenhamzi01-dot]

Hi @rohityan, I've fixed the formatting issues raised by the pre-commit checks. Could you please approve the workflows to run the tests? Thank you!