Missing security backport on `release/1.5.x`: CVE-2022-0845

Hi maintainers — I noticed `release/1.5.x` does not contain the security fix from upstream `master` for **CVE-2022-0845**. **What's missing** Commit [`8b7a12c52e52`](https://github.com/Lightning-AI/pytorch-lightning/commit/8b7a12c52e52a06408e9231647839ddb4665e8ae) (Replace `eval()` with `ast.literal_eval()` for security (#12212)) — addressing eval() on environment variable contents — is present on `master` but not on `release/1.5.x`. A direct content check on the modified files confirms the post-patch marker (`val = literal_eval(val)`) is absent on `release/1.5.x`, while the pre-patch form `val = eval(val)` is still present in `pytorch_lightning/utilities/argparse.py::parse_env_variables`. **Why this matters** CVE-2022-0845 (CWE-94) — anyone running `release/1.5.x` is still exposed to the issue described in the upstream advisory: arbitrary code execution by anyone able to set `PL_TRAINER_*` environment variables. **Proposed fix** Cherry-pick `8b7a12c52e52` onto `release/1.5.x` (or apply the equivalent change manually if conflicts arise) and cut a patch release. I'm tracking unbackported fixes across maintained branches and would be glad to help test a backport PR if useful. Thanks for your work on this project.