Potential fix for code scanning alert no. 55: Information exposure through an exception

[dkackman]

Potential fix for https://github.com/dkackman/diffusers-workflow/security/code-scanning/55

The best fix is to stop returning raw exception messages from Workflow.validation_errors() and return stable, generic messages instead, while preserving useful location info (path) and existing API shape.

Specifically, in dw/workflow.py inside validation_errors():

• Replace str(e) for:
  • ForEachError with a generic message like "Invalid for_each configuration"
  • ConstantError with "Invalid constant reference or constant value"
  • VariableCycleError with "Variable cycle detected"
• Keep path fields unchanged (e.path and "variables") so clients still get actionable location context.
• Do not change return structure or control flow, so functionality remains equivalent (validation still fails and reports structured errors), but sensitive internals are no longer exposed.

No changes are required in dw/server/app.py once upstream messages are sanitized.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.