Tighten task authorization policy validation

[vikranthreddimasu]

Summary

• Tighten remote task authorization policy validation so string/non-collection task sets are rejected instead of being treated as iterables.
• Normalize accepted task-name collections to frozenset and reject contradictory allow/deny overlap.
• Add a distinct worker audit event for remote task authorization denials.

Security changes

• Prevent confusing or unsafe remote task policy configuration from slipping through runtime validation.
• Record task.authorization_denied separately from generic task.failed so denied remote execution attempts are easier to investigate.

Usability changes

• Policy misconfigurations now fail at construction with direct ValueError messages.
• Authorization-denial audit records include task name, coordinator, and denial reason.

Tests/checks run

• python -m pytest tests/test_compute/test_authz.py tests/test_compute/test_dispatch.py -q
• make lint
• make test (1030 passed, 2 warnings)
• git diff --check master...HEAD
• Diff-only secret scan with rg

Commits

• 64018cf Tighten task authorization policy validation
• eab80df Audit remote task authorization denials
• db3da68 Fix task policy type narrowing

Risks / manual review notes

• This touches remote task authorization behavior, so it should receive manual review before merge.
• Existing callers passing strings for allowed_tasks or denied_tasks will now get a configuration error instead of accidental character-wise membership behavior.

Merge status

• Not merged; left open because the change touches authorization policy.