Fix unsafe pickle deserialization and CI workflow unauthorized execution

[liu-shaojun]

Description

Security fixes for two vulnerabilities in BigDL: unsafe pickle deserialization across distributed training workers, and unauthorized code execution via CI workflow on self-hosted runner.

1. Why the change?

Vulnerability 1 — Unsafe Pickle Deserialization (CVE-worthy)

All four distributed training backends (MPI, Horovod, PyTorch DDP, TensorFlow) accept CLI-controlled file paths and immediately deserialize pickle files using cloudpickle.load() without any integrity verification. In distributed deployments, a single malicious pickle payload achieves cluster-wide arbitrary code execution.

Affected worker scripts:

• python/orca/src/bigdl/orca/learn/mpi/mpi_train.py
• python/nano/src/bigdl/nano/deps/horovod/horovod_worker.py
• python/nano/src/bigdl/nano/pytorch/strategies/worker.py
• python/nano/src/bigdl/nano/utils/tf/subprocess_worker.py

Vulnerability 2 — CI Workflow Unauthorized Code Execution

The performance-regression-test.yml workflow allows any GitHub user to trigger code execution on the self-hosted runner (Rohan) by commenting APRT on any PR. No author_association check exists. Additionally, the pull_request trigger lets fork PRs override the workflow definition itself.

2. User API changes

No user-facing API changes. SafePickle.dump() and SafePickle.load() maintain the same interface but now always perform HMAC integrity verification. The HMAC key is auto-generated per session and propagated to subprocesses via BIGDL_SAFE_PICKLE_KEY environment variable.

3. Summary of the change

Pickle deserialization fix:

• Replace all cloudpickle.load()/cloudpickle.dump() calls in worker scripts and their callers with SafePickle.load()/SafePickle.dump()
• Upgrade SafePickle (in nano, ppml, friesian packages) from hardcoded b'shared-key' + SHA1 to per-session random 256-bit key + HMAC-SHA256
• dump() now auto-generates .sig sidecar files containing the HMAC digest
• load() mandates signature verification — rejects unsigned or tampered pickle files
• Use timing-safe hmac.compare_digest() to prevent timing attacks
• Propagate HMAC key to MPI workers via mpiexec -genv and to subprocesses via inherited environment
• SCP .sig files alongside .pkl files for remote MPI nodes

CI workflow fix:

• Remove the pull_request trigger that allowed fork PRs to override the workflow definition on the self-hosted runner
• Add author_association guard (MEMBER, OWNER, or COLLABORATOR) to the issue_comment trigger

4. How to test?

• The pickle deserialization fix can be verified by attempting to load an unsigned or tampered pickle file — SafePickle.load() will raise an error
• The CI workflow fix can be verified by checking that the if condition now requires author_association membership
• Unit test
• Application test

5. New dependencies

No new dependencies introduced. All changes use Python standard library modules (hmac, hashlib, os) that were already imported.