fix(components): replace eval() with ast.literal_eval() for safe metadata parsing

[janickm]

Summary

• Replace eval() with ast.literal_eval() in PosesComponent.Reader for parsing tuple keys from zarr metadata
• eval() is a code execution vector; ast.literal_eval() safely parses Python literals without executing arbitrary code
• Drop-in replacement -- behavior is identical for the tuple string keys stored in zarr attrs

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[janickm]

/ok to test 62fceb1