agents: block all stdlib modules in agent-config code-refs (denylist bypass via cProfile.run/timeit)

[asroyxCySec]

Problem

config_agent_utils._validate_module_reference() protects YAML agent configs against arbitrary code execution by blocking a hand-maintained denylist of dangerous stdlib modules (_BLOCKED_MODULES) referenced in tool / callback / model / schema code-refs. The check only compares the top-level module name against the denylist.

A top-level-name denylist is inherently incomplete: equivalent code-execution gadgets that are not in the list slip through. The clearest example is already visible in the current list — profile is blocked (its profile.run("<code>") executes arbitrary code), but its C sibling cProfile is not, and cProfile.run("<code>") is the identical gadget. Other reachable, non-listed gadgets include timeit.timeit("<code>"), pydoc, logging.config.fileConfig, bdb, trace, and venv.

Example bypass (before this change):

from google.adk.agents import config_agent_utils
# passes validation, then resolves to a callable that runs arbitrary code:
run = config_agent_utils.resolve_fully_qualified_name("cProfile.run")
run("open('/tmp/pwned','w').write('rce')")

Fix

Agent-config code-refs point to user-defined or ADK packages, never to the Python standard library. So instead of chasing individual gadgets, reject any standard-library top-level module via sys.stdlib_module_names (Python 3.10+, which matches the project's requires-python). The existing _BLOCKED_MODULES set is kept as documentation / belt-and-suspenders. Legitimate references (user packages, google.adk.*) are unaffected because they are not part of sys.stdlib_module_names.

Testing

• New parametrized regression test test_stdlib_gadget_modules_are_rejected covers the previously-bypassing gadgets (cProfile.run, timeit.timeit, pydoc, logging.config.fileConfig, bdb, trace, venv).
• New test_non_stdlib_references_are_not_blocked confirms user/ADK references still validate.
• Existing blocked-module tests (os, subprocess, network modules, denylist-disable) continue to pass.
• Verified the patched _validate_module_reference directly: all listed gadgets + the existing denylist entries are rejected, while my_company_pkg.my_tool and google.adk.tools.google_search are allowed.