Sync missing CVE/security fixes from upstream

[artursarlo]

Summary

This PR backports security fixes that landed in upstream (intel/gprofiler) but were never synced into our fork. The two forks diverged in May 2024, and a scan of upstream's CVE-related PRs found three runtime/build hardening changes we are missing. Each change below mirrors upstream exactly.

Changes & rationale

1. Bump pytest to 9.0.3 (+ pytest-rerunfailures==15.0)

Backports intel/gprofiler#1035.

• CVE-2025-71176 (Medium, CVSS 6.8): pytest through 9.0.2 on UNIX relies on directories with the /tmp/pytest-of-{user} name pattern, which allows local users to cause a denial of service or possibly gain privileges via the predictable tmpdir handling.
• Fix: upgrade to pytest 9.0.3+.
• pytest-rerunfailures==15.0 is added alongside for pytest 9.x compatibility, matching upstream.

Test/dev dependency only — not shipped in the profiler runtime.

2. Pin Alpine base image to 3.24.1

Backports intel/gprofiler#1010 (later bumped to 3.24.1 in intel/gprofiler#1046).

• Our container.Dockerfile used FROM alpine (floating latest), which is non-reproducible and can silently pull a stale/vulnerable image from cache.
• Setting an explicit tag addresses security vulnerabilities in older Alpine images and guarantees a reproducible base.

3. Add backports.tarfile==1.2.0 + pyinstaller hidden import

Backports the tarfile-extraction hardening from intel/gprofiler#1010.

• Adds backports.tarfile==1.2.0 to requirements.txt.
• Declares hiddenimports=['backports.tarfile'] in pyinstaller.spec so the module is bundled into the PyInstaller executable.

Notes

• Unrelated upstream changes bundled in the same PRs (e.g. the cpuid dependency, removal of bitmath) were intentionally excluded — this PR is scoped strictly to the CVE/security fixes.
• Already-in-sync CVE fixes require no action here: requests==2.33.0 and black==26.3.1 are already present in our fork.

Test plan

• CI build passes with the pinned Alpine image and bundled backports.tarfile.
• Test suite runs on pytest 9.0.3.