fix: parse layer patterns instead of evaluating them

[shiaho777]

_eval_pattern allowed digits, brackets, and * and then called eval. That blocks names and attribute access. It still accepts [0]*10**9, which allocates the list inside eval. moe_layer_freq, linear_attention_freq, no_rope_freq, and window_attn_skip_freq all go through this function when the value contains a bracket.

The same list grammar is now a small parser: lists of integers, concatenation with +, and repetition with *. A result longer than 100000 items is rejected, and ** is rejected. ([0]*3+[1]*1)*3 still expands to [0, 0, 0, 1] repeated three times.

Checked with python3 -m pytest tests/test_layer_pattern.py. flake8 is clean.