warn on unpinned revisions for trust_remote_code model specs

### Problem (supply-chain hardening)

Several model specs that set `trust_remote_code=True` reference third-party Hugging Face repositories by a moving revision (no revision, or `main`), rather than a pinned commit. `trust_remote_code=True` executes code from the repo at load time, so a moving ref means a force-push or account compromise on the upstream repo could change the code docling runs. There is also one direct `hf_hub_download` (in the ASR transcriber) with no `revision` pinned.

### Proposed fix

Add a single chokepoint in the model-download path that detects a moving revision (anything that is not a 40-hex commit SHA) and, when `trust_remote_code=True`, emits a prominent security warning naming the repo (and can be made to refuse via an opt-in setting). This does not change default behavior and does not require pinning specific SHAs (maintainers can pin the real commits over time); it makes the risk visible and configurable.

A PR implementing this follows.

Start at the model-download path and inspect the ASR transcriber’s direct hf_hub_download call. Trace how model specs pass trust_remote_code and revision, then ensure moving revisions trigger a prominent warning naming the repository while preserving default behavior. Done means the warning covers revisions that are not 40-hex commit SHAs.

Written by the indexing model from the issue text.