fix: remove unsafe pickle deserialization in txt_to_obj (CVE CWE-502)

[YashasviChaurasia]

Description of the change

Remove the pickle.loads fallback in txt_to_obj() which allowed arbitrary code execution via crafted base64 payloads in the SFT_TRAINER_CONFIG_JSON_ENV_VAR environment variable (CWE-502). The function now only accepts JSON. The corresponding serialize_args() in build/utils.py is updated to use json.dumps instead of pickle.dumps.

Related issue number

Closes CVE report: Deserialization of Untrusted Data (CWE-502, CVSS 9.9 Critical)

How to verify the PR

1. Confirm pickle is no longer imported or used in tuning/utils/config_utils.py or build/utils.py
2. Run: PYTHONPATH=. pytest tests/utils/test_config_utils.py::test_get_json_config_can_load_from_envvar -v
3. Verify the previous exploit payload (base64-encoded pickle opcodes) now raises a json.JSONDecodeError instead of executing

Was the PR tested

• I have added >=1 unit test(s) for every new method I have added.
• I have ensured all unit tests pass

[github-actions]

Thanks for making a pull request! 😃
One of the maintainers will review and advise on the next steps.

[dushyantbehl]

@YashasviChaurasia do we know why some tests are failing here?
if its only mlflow tests then can you disable them in the workflow as part of the PR.

[dushyantbehl]

LGTM apart from minor request

[dushyantbehl]

@YashasviChaurasia I have merged this PR...please see if any test case run needs fixing. We can merge it separately.