block yaml deserialization in agent-config code references

[prasanna8585]

Summary

_validate_module_reference()'s denylist blocks the standard library plus a short explicit list of stdlib-adjacent modules -- but, as commit a16f6da's own message states, "cannot cover third-party packages" in general.

adk-python depends on PyYAML unconditionally (pyyaml>=6.0.2,<7 in pyproject.toml, not an optional integration). yaml.unsafe_load / yaml.load / yaml.full_load are single-argument functions that construct arbitrary Python objects from the YAML document they're given, via tags such as !!python/object/apply:os.system. None of these were blocked.

Referenced as a tool with no declared args -- the same entry point the already-fixed cProfile.run exploit used (see this file's own test_resolve_tools_blocks_exec_capable_stdlib, whose docstring describes "the path the reported exploit takes") -- the resolved function is exposed directly as a callable tool. A functionCall dispatching to it with a malicious YAML string as the argument achieves full RCE.

Verification

Confirmed dynamically against the real, installed package before this fix:

Resolved: <function unsafe_load at 0x...>
Marker file exists: True   # written via !!python/object/apply:os.system

And after this fix, the same input is rejected:

Blocked module reference: 'yaml.unsafe_load'. ...

Fix

Add yaml to _BLOCKED_MODULES, matching this file's existing pattern for other named, load-bearing entries (distutils, test, etc.) that aren't covered by the stdlib-name check.

Testing

• 6 new regression tests: yaml.unsafe_load / yaml.load / yaml.full_load, both as a direct code reference and as a resolved tool.
• Full test_agent_config.py: 121 passed.
• Full tests/unittests/agents/ suite (excluding 3 files requiring optional extras not installed in my environment -- a2a, mcp): 576 passed, 1 skipped, 2 xfailed, zero regressions.
• Confirmed no regression to the existing stdlib denylist or to legitimate third-party references (test_third_party_module_reference_is_not_blocked still passes: pydantic.BaseModel remains resolvable).

Scope note

This closes the specific, demonstrated gap (a hard, always-installed dependency with an unconditional deserialization gadget). It does not close the general third-party-package gap the original fix's commit message already identifies -- that would need either an allowlist of approved third-party callables or a different trust model for third-party code references, which felt like a larger design discussion better suited to a maintainer decision than a PR.