Hydra: Optuna custom_search_space can resolve and execute untrusted callables via get_method
hydra-optuna-sweeper accepted a configuration-controlled dotted path in hydra.sweeper.custom_search_space, resolved it with the lower-level hydra.utils.get_method() API, and later invoked the returned callable. Hydra's object-lookup helpers intentionally trust their input and do not apply the execution policy used by instantiate() and logging configuration. As a result, untrusted Optuna multirun configuration could select installed Python code for execution in the Hydra controller process.