Vendor patched PLY parser

[AndreyVMarkelov]

Summary

• vendor the PLY 3.11 lexer and parser runtime inside Stone
• remove the complete pickle-table API, including picklefile, read_pickle(), and pickle_table()
• remove the external ply runtime dependency
• include BSD licensing, source provenance, and security regression tests
• exclude vendored third-party code from first-party lint and type analysis

Why

PLY 3.11 on PyPI contains an unsafe pickle deserialization path reported as CVE-2025-56005, and the upstream project was archived in December 2025. Stone does not call that path today, but there is no maintained fixed PyPI release. Vendoring the exact runtime and deleting the vulnerable feature removes the dependency alert while preserving the existing lexer, grammar, AST, positions, and error behavior.

SDK impact

There is no intended public parser or generated-SDK behavior change. Stone wheels no longer declare a dependency on the external ply distribution. The vendored license and provenance note are included in both wheel and source distributions.

Validation

• python3 -m unittest discover -q — 188 tests passed
• security regression tests verify pickle APIs are absent and picklefile= is rejected
• Flake8 passed
• Pylint passed with 10.00/10
• Mypy passed for affected first-party files
• wheel and source distribution built successfully
• clean wheel installation parsed a Stone specification without external ply
• wheel metadata contains no ply requirement