Avoid eval when parsing btrun kwargs

[williamhsiao0403]

Summary

Replaces eval() usage in backtrader.btrun when parsing CLI kwargs with a safer AST-based parser.

The previous implementation evaluated user-controlled command-line input such as:

• --cerebro
• --writer
• --plot
• strategy / indicator / observer / analyzer kwargs
• hook kwargs

This keeps the existing key=value syntax for literal values while rejecting function calls and other executable Python expressions.

Changes

• Add parse_kwargs() using ast.parse + ast.literal_eval
• Replace eval('dict(...)') calls in btrun.py
• Add regression tests for literal parsing and rejected code execution

Verification

Tested with Python 3.13.1:

python tests/test_btrun.py
python -m compileall -q backtrader/btrun tests/test_btrun.py
python -m bandit -r backtrader/btrun -s B311

pip-audit also reported no known vulnerabilities.