[FEATURE] Better documentation on how security is guaranteed for the mapping files

[mgovers]

Describe the feature request

In the mapping files (see for example this test mapping file, it is possible to specify a custom mapping or filter function (see this example).

Since this custom function may be any function from the power-grid-model-io, be provided by the user, or even be provided by a third-party, it is a good idea to treat this functionality with care. To help users with this, better documentation is needed that explains:

• [ ] we use the PyYAML yaml.safe_load functionality to make sure that the configuration file is loaded in a way that no malicious code injection happens during the loading step.
• [ ] we do not use eval-like functionality
• [ ] instead, we only allow usage of loadable/loaded functions and symbols such that they are:
  • [ ] Python builtins; or
  • [ ] prefixed by their relative or absolute import path, such that the parent module is importable using import_module.
  • [ ] e.g., max and numpy.max are importable, but np.max is not.
• [ ] because of these rules, no other code is included like the following typical example case of malicious code injection

  lambda x: return (malicious_code(), normal_code(x))[1]

  which would in normal operation be provided directly as normal_code, but in addition to that, also has the malicious_code as a side effect.

• [ ] in a production environment, the configuration file should be treated similar to how Python source files are treated. I.e., it should have similar file permissions, or at the very least only be allowed to be changed by users/services with the correct privileges.

[mgovers]

Resolved in #255