fix: use safe deserialization and tarfile extraction

[gn00295120]

Summary

• Add weights_only=True to all torch.load() calls to prevent arbitrary code execution via pickle deserialization (CVE-2025-32434, CWE-502)
• Add filter='data' to all tarfile.extractall() calls to prevent path traversal attacks (CVE-2007-4559, CWE-22)

Files Changed

File	Fix
moshi/moshi/models/lm.py line ~979	torch.load(..., weights_only=True)
moshi/moshi/models/loaders.py lines ~160, ~217, ~295	torch.load(..., weights_only=True)
moshi/moshi/server.py lines ~333, ~349	tarfile.extractall(..., filter='data')
moshi/moshi/offline.py line ~145	tarfile.extractall(..., filter='data')

Security Impact

torch.load() without weights_only=True deserializes arbitrary Python objects via pickle, allowing remote code execution if a malicious checkpoint file is loaded. The weights_only=True flag restricts deserialization to tensor data only.

tarfile.extractall() without filter='data' can be exploited via crafted archives containing ../ path components (tar slip / directory traversal). The filter='data' argument (available since Python 3.12, backported to 3.11.4+) strips dangerous metadata and blocks absolute/traversal paths.

Test Plan

• Verify model loading still works with weights_only=True on standard .pt checkpoints
• Verify tarfile extraction of voices.tgz and dist.tgz succeeds with filter='data'
• Confirm no regressions in existing test suite