fix(starter): default trust_remote_code to false for sentence-transformers

The starter distribution set trust_remote_code: true for the
sentence-transformers embedding provider, so loading any model from the
HuggingFace Hub would execute code bundled with that repository. A compromised
or malicious model could use this to run arbitrary code on the OGX server. The
starter distribution is the template most new deployments copy, so it should
use the secure default that the config class itself documents. Restore
trust_remote_code: false and regenerate the distribution configs; deployments
that need remote code for a specific model can still opt in per provider.

Closes #6311.

Signed-off-by: Yash Anil <yashanil98@gmail.com>

Author: yashanil98

src/ogx/distributions/starter/config.yaml

@@ -98,7 +98,7 @@ providers:
   - provider_id: sentence-transformers
     provider_type: inline::sentence-transformers
     config:
-      trust_remote_code: true
+      trust_remote_code: false
   vector_io:
   - provider_id: faiss
     provider_type: inline::faiss

src/ogx/distributions/starter/run-with-postgres-store.yaml

@@ -98,7 +98,7 @@ providers:
   - provider_id: sentence-transformers
     provider_type: inline::sentence-transformers
     config:
-      trust_remote_code: true
+      trust_remote_code: false
   vector_io:
   - provider_id: faiss
     provider_type: inline::faiss

src/ogx/distributions/starter/starter.py

@@ -171,7 +171,7 @@ def get_distribution_template(name: str = "starter") -> DistributionTemplate:
     embedding_provider = Provider(
         provider_id="sentence-transformers",
         provider_type="inline::sentence-transformers",
-        config=SentenceTransformersInferenceConfig(trust_remote_code=True).model_dump(),
+        config=SentenceTransformersInferenceConfig(trust_remote_code=False).model_dump(),
     )
     responses_provider = Provider(
         provider_id="builtin",