fix: replace eval with a safer alternative

[HarikrishnanBalagopal]

Description of the change

Use the AST module to evaluate the rules instead of eval.

1. We use the Python AST library to parse the code.
2. We use this library https://github.com/danthedeckie/simpleeval for traversing and evaluating the generated AST.
3. The output of evaluation should be a boolean value which we return indicating if the rule succeeded.

Example supported expressions: https://github.com/danthedeckie/simpleeval?tab=readme-ov-file#operators

Support for more complex types (list, dict, etc.) are also implemented:

• https://github.com/danthedeckie/simpleeval?tab=readme-ov-file#compound-types
• https://github.com/danthedeckie/simpleeval/blob/2a12b5856d6f70b78dc1ac38840c80c1be6c6c4e/simpleeval.py#L638-L642

Notes:

• PyPi https://pypi.org/project/simpleeval/ (MIT Licence)
• Array Multiplication ["hello"]*10 is allowed but limited to smaller numbers to avoid Denial of Service (DOS).
• List comprehension is allowed but limited to small number of iterations to avoid DOS.
• Exponentiation 9**9 is allowed but limited to smaller numbers to avoid DOS.
• Access to double underscore attributes like __class__ is disallowed to avoid access to arbitrary classes like Quitter.
• Lambda expressions are disallowed for simplicity and to reduce the attack surface. Can be added back in if necessary.
• Access to builtin functions and globals are disallowed expect for int, float, str, rand and randint.
• Has support for accessing keys in dicts using the short syntax:foo.bar . Example dict: {"foo": {"bar": 42}})

Related issue number

Fixes #148

How to verify the PR

Have added unit tests for the safe evaluator.

make test

Was the PR tested

• I have added >=1 unit test(s) for every new method I have added.
• I have ensured all unit tests pass

[alex-jw-brooks]

Thanks, this is a really interesting contribution - a lot of questions and one request to split the PR up a little 😄

[alex-jw-brooks]

Any thoughts on making this part of the class, e.g., as a staticmethod? It feels a bit strange to me to store it separately here like this

[HarikrishnanBalagopal]

EvalWithCompoundTypes is coming directly from the library.
Making it a static method would require overriding the class.
Since this is just a utility function I have moved it to a more appropriate location.
We can also remove the function entirely if necessary.

[alex-jw-brooks]

Looks good to me. LGTM, thanks!