Add ML deserialization rules (torch.load, joblib, pandas.read_pickle,…

[DipesThapa]

Adds python/lang/security/deserialization/ml-deserialization.yaml with four audit rules for pickle-backed ML deserialisers that aren't currently covered:

• avoid-torch-load-untrusted — torch.load() without weights_only=True
• avoid-joblib-load — joblib.load()
• avoid-pandas-read-pickle — pandas.read_pickle() / pd.read_pickle()
• avoid-numpy-allow-pickle — numpy.load(..., allow_pickle=True)

These are the model-file attack surface (CWE-502) behind many recent AI/ML CVEs. The deserialization/ folder currently covers pickle, jsonpickle, pyyaml and ruamel but none of these four ML loaders, so this is net-new coverage. Rules follow the existing deserialization conventions (metadata, avoid-* ids, constant-string pattern-not to reduce false positives), and the test file passes via semgrep --test (4/4).

Resolves #3990.

[CLAassistant]

All committers have signed the CLA.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}