v0.42.1 — fix component resolution in `from_pretrained` to prevent `trust_remote_code` bypass

This is a security release. See GHSA-4prv-5hj7-c2xr for details.

This patch release fixes how a component's declared library name is resolved when loading with from_pretrained.

Pipelines and models declare each component as a ["<library>", "<class>"] pair in model_index.json / config.json. This release changes how that library name is resolved across the DiffusionPipeline, AutoModel, and ModularPipeline loading paths, and adds a clearer error when the declared class is not found in the resolved module.

All users on 0.42.0 are encouraged to upgrade:

pip install diffusers==0.42.1