note on pickle (#86685)

lib/ansible/module_utils/connection.py

@@ -159,6 +159,8 @@ class Connection(object):
         if response['id'] != reqid:
             raise ConnectionError('invalid json-rpc id received')
         if "result_type" in response:
+            # NOTE: while pickle.loads is normally a concern, in this case it is controller code on the same
+            # machine and user in a private restricted path, any substitution would require same privs.
             response["result"] = pickle.loads(to_bytes(response["result"], errors="surrogateescape"))
 
         return response