to_code does not check whether components names are valid Python variable names

[ZanSara]

Describe the bug

• Pipeline.to_code trusts blindly that the name of each component can be used as a valid Python variable name.
• This leads to the possibility of generating arbitrary code through proper naming of the components, see Generate code from pipeline (pipeline.to_code()) #2214 (comment)

Solution:
to_code should clean the compoent names before using them.

• it could use unicodedata.category() to filter out control characters, for example.
• It could also apply a strong regex on component names and replace anything that is not alphanumeric with an underscore.

@tstadel