Replace eval with ast.literal_eval for safety

[VamsiSudhakaran1]

Summary

The UI-TARS grounding agent parses coordinate boxes out of the model's own
action output and evaluates them with eval(). eval on model-derived data is
a code-execution anti-pattern; ast.literal_eval parses the same list/tuple
literals but cannot execute code, so this is a safe, behavior-preserving swap.

Where

src/khoj/processor/operator/grounding_agent_uitars.py — 8 call sites
(lines 682, 685, 695, 720, 879, 882, 891, 918). For example:

start_box = action_inputs.get("start_box")
...
x1, y1, x2, y2 = eval(start_box)   # start_box originates from the model's action string

action_inputs is populated by parse_action_to_structure_output(text=...)
from the model's generated text, so the value reaching eval() is model-derived.
For a computer-use agent that acts on screenshots, that output is influenceable
by on-screen content (a page the agent views can carry injected instructions),
so in any path where a raw box value reaches eval unnormalized, a steered
model could emit something other than [x1, y1, x2, y2]. Even where the value
is numeric-normalized first, eval is the wrong tool here.

Fix

Replace eval(...) with ast.literal_eval(...) at these sites (ast is
already imported in this file). Verified parse-equivalent on the real inputs
([0.1, 0.2, 0.3, 0.4], (0.12, 0.34)), and that a non-literal string now
raises ValueError instead of executing.