Pyyaml: Make safe loading the default

[itamarst]

Every once in a while I do this GitHub search: https://github.com/search?q=yaml.safe_load&type=commits

As you see in the results, there continue be many many people who use the insecure default; some of them discover the problem eventually, presumably not all.

The default should be secure.

[nitzmahone]

That's exactly what pyyaml 4.x did, and the outcry of "YOU BROKE EVERYTHING" was so loud and hard that it got rolled back.

[itamarst]

There are solutions. For example:

1. Release version as betteryaml or something, with new secure defaults.
2. For existing package, have it print a warning everytime you import it saying "this is deprecated, switch to betteryaml, it's exactly the same except this minor change".

Or, just ignore the complaints. Nothing will make _everyone_ happy. "A small vocal minority of people with obscure use cases means a continued stream of security flaws" is... not an ideal outcome.

[ingydotnet]

This is planned for version 6.0 (Q1 2021),