Restrict LCB private test case unpickling

[resolvicomai]

Summary

• load LCB private test case payloads with a restricted unpickler that rejects pickle globals
• preserve the existing pickled JSON string payload format
• add focused coverage for normal payloads and unsupported global constructors

Tests

• PYTHONPATH=src uv run --with pytest --with numpy --with tqdm pytest tests/unit/tasks/tasks/lcb/test_codegen_metrics.py -q
• PYTHONPATH=src uv run --with ruff ruff check src/lighteval/tasks/tasks/lcb/codegen_metrics.py tests/unit/tasks/tasks/lcb/test_codegen_metrics.py
• PYTHONPATH=src uv run --with ruff ruff format --check src/lighteval/tasks/tasks/lcb/codegen_metrics.py tests/unit/tasks/tasks/lcb/test_codegen_metrics.py
• PYTHONPATH=src uv run python -m py_compile src/lighteval/tasks/tasks/lcb/codegen_metrics.py tests/unit/tasks/tasks/lcb/test_codegen_metrics.py