GHSA-2cp2-2r3c-7p7r: Hydra: hydra.utils.instantiate with untrusted config can lead to code execution

Hydra's `instantiate()` function (which constructs objects and calls functions based on configuration files) can execute arbitrary code if an attacker controls the `_target_` field in untrusted config. This means if your application loads config from an untrusted source and passes it to `instantiate()`, an attacker can trick it into running malicious code.