fix: reject unknown names in threat conditions

[rajanpanth]

Summary

• reject unknown names while validating threat condition expressions
• preserve names introduced by list/generator comprehensions
• add regression coverage for unknown names and comprehension variables

Testing

• py -3.12 -m compileall pytm\threat.py tests\test_pydantic_models.py
• git diff --check
• py -3.12 -m pytest tests\test_pydantic_models.py::TestConditionValidator -q in a temporary local venv

[NoodlesNZ]

Looks fine to me, although should include some additional changes:

_build_eval_globals should include an entry for LLM. While this doesn't break anything right now, if someone was writing threats using this element then it would error out.

We should also include a mention in CHANGELOG when we next release as this is a breaking change and may catch out legacy users.