Secures the tool use server behind an API key.

[finbarrtimbers]

Previously, the tool use server was exposed publicly. Whoops!

Tested locally:

$ curl -X POST http://localhost:1212/execute \
     -H "Content-Type: application/json" \
     -d '{"code": "import time;time.sleep(4)", "timeout": 3}' \
     -w '\nTotal time: %{time_total}s\n'
{"detail":"Missing API key"}
Total time: 0.003643s
$ curl -X POST http://localhost:1212/execute \
     -H "Content-Type: application/json" \
     -H "X-API-Key: $OPEN_INSTRUCT_TOOL_API_KEY" \
     -d '{"code": "import time;time.sleep(4)", "timeout": 3}' \
     -w '\nTotal time: %{time_total}s\n'
{"output":"","error":"execution timed out\nTraceback (most recent call last):\n  File \"/app/tool_server.py\", line 198, in _run_user_code\n    exec(compiled, {})  # noqa: S102\n  File \"<user-snippet>\", line 1, in <module>\n  File \"/app/tool_server.py\", line 187, in _timeout_handler\n    raise TimeoutError(\"execution timed out\")\nTimeoutError: execution timed out\n","success":false}
Total time: 3.040558s