Address review: bind test sockets to localhost instead of all interfaces

Fix CodeQL security warning by binding test helper sockets to
"localhost" instead of "" (all interfaces). These sockets are only
used for finding a free port for torch distributed init in tests.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Alexander Matveev <alexm-redhat@dgx-b200-02.mgmt.accl-001.lab.rdu2.dc.redhat.com>

tests/distributed/_test_push_ar_worker.py

@@ -19,7 +19,7 @@ import torch.distributed as dist
 def find_free_port() -> int:
     """Find a free TCP port for distributed init."""
     with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
-        s.bind(("", 0))
+        s.bind(("localhost", 0))
         return s.getsockname()[1]
 
 

tests/distributed/test_push_all_reduce.py

@@ -51,7 +51,7 @@ def _find_free_port() -> int:
     import socket
 
     with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
-        s.bind(("", 0))
+        s.bind(("localhost", 0))
         return s.getsockname()[1]