Security: fix ACL privilege escalation + hardening

[jacquelinegarrahan]

Security review of p4p. One real vulnerability plus three low-severity hardening items.

HIGH — Privilege escalation via in-place mutation of shared UAG state

src/p4p/asLib/__init__.py — Engine.create() did uags = self._uag.get(user, set()) then uags |= …role…. Because .get() returns the stored set, the in-place |= permanently merged client-asserted (forgeable, under default ca auth) roles into that account's process-global group membership. A single connection could permanently elevate an account; every later evaluation of that account — including role-less sessions from other hosts and the periodic _recompute() — then inherited the escalation. Fixed by copying the set before the union.

Reproduced against the compiled Engine: unpatched, _uag['alice'] goes ['OPS'] → ['ADMINS','OPS'] and stays; patched, it stays ['OPS'].

Low — hardening

• CI least-privilege: add permissions: contents: read to build.yml/ci-scripts.yml (publish uses TWINE secrets, not the token).
• Native except+: monPop/opHandler/opBuilder/opEvent in _p4p.pyx lacked the exception spec every sibling has; an unexpected C++ exception (e.g. std::bad_alloc from pop()) would std::terminate the interpreter instead of raising.
• dynamic_cast guard in pvxs_source.cpp::disconnectDynamic (defense-in-depth against a future NULL deref).

Verification

Built against epicscorelibs 7.0.10 / pvxslibs 1.5.2 — the native changes compile cleanly and the full test suite passes (157 tests, 2 skipped).

[jacquelinegarrahan]

Reviewer note — this is the priority PR of a small batch.

This is 1 of 11 PRs from a review of p4p (#214–#224). The other ten (#214–#223) are independent single-commit correctness fixes; this one is the only security-relevant change, so it's worth looking at first.

The load-bearing part is the asLib fix (HIGH): Engine.create() mutated the shared self._uag[user] set in place when merging client-asserted roles, permanently escalating that account's group membership for all later sessions. The other three items in this PR are low-severity hardening (CI token scope, native except+, a dynamic_cast NULL guard) and could be split out if you'd prefer the security fix land on its own — happy to do that.

Each PR is independent and touches disjoint lines, so they can be reviewed/merged in any order. All were built against epicscorelibs 7.0.10 / pvxslibs 1.5.2 and pass the full suite (157 tests, 2 skipped); every fix was also reproduced against the compiled library (buggy on master, fixed on the branch). The only red CI I've seen is an intermittent RefTestCase reference-leak failure on the windows-latest / 3.13 runner that also flakes on unrelated changes — not introduced here.