[Modular] Provide option to disable custom code loading globally via env variable

[DN6]

What does this PR do?

Based on discussion here:
#12033

Add an option to globally disable any downloading of remote code via an env variable. This is a bit of a guard against wrapper code around diffusers that might automatically download remote code without the user knowing.

Note. It's not 100% foolproof since wrapper code could also override the env variable before doing any diffusers imports. I don't have a great solution for this at the moment. For now, I've added a warning for every time remote code is downloaded so that the user is at least alerted when this is happening.

cc: @JoeGaffney

Fixes # (issue)

Before submitting

• This PR fixes a typo or improves the docs (you can dismiss the other checks if that's the case).
• Did you read the contributor guideline?
• Did you read our philosophy doc (important for complex PRs)?
• Was this discussed/approved via a GitHub issue or the forum? Please add a link to it if that's the case.
• Did you make sure to update the documentation with your changes? Here are the
  documentation guidelines, and
  here are tips on formatting docstrings.
• Did you write any new necessary tests?

Who can review?

Anyone in the community is free to review the PR once the tests have passed. Feel free to tag
members/contributors who may be interested in your PR.

[HuggingFaceDocBuilderDev]

The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update.

[JoeGaffney]

Hey @DN6,

Thanks for this looks like a solid mechanism.

You’re right that someone could technically do:

os.environ["DIFFUSERS_DISABLE_REMOTE_CODE"] = "0"
import diffusers

But in practice, this is mostly fine. The env var is read at import time, so once diffusers is imported, the value is cached and later changes won’t affect behavior.

Making it opt-in is probably a good call to avoid breaking existing workflows. In production or more secure environments, users can enable this to enforce stricter control over remote code execution.

[yiyixuxu]

thanks1