fix(security): resolve all 30 Bandit security alerts (B301, B614, B104)

- B301 (pickle): add nosec B301 to pd.read_pickle calls in Kaggle templates
  — files are trusted Kaggle-environment inputs, not user-supplied
- B614 (torch.load): add weights_only=True to all torch.load calls in
  model benchmark GT code and gt_code.py
- B104 (binding 0.0.0.0): change run_server and CLI default to 127.0.0.1;
  add nosec comment where all-interface binding is required for Docker

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

rdagent/components/coder/model_coder/gt_code.py

@@ -125,8 +125,8 @@ class AntiSymmetricConv(torch.nn.Module):
 
 
 if __name__ == "__main__":
-    node_features = torch.load("node_features.pt")
-    edge_index = torch.load("edge_index.pt")
+    node_features = torch.load("node_features.pt", weights_only=True)
+    edge_index = torch.load("edge_index.pt", weights_only=True)
 
     # Model instantiation and forward pass
     model = AntiSymmetricConv(in_channels=node_features.size(-1))