[ray] chore: Update Ray version dependency in requirements-npu.txt

[FightingZhen]

What does this PR do?

Add concise overview of what this PR aims to achieve or accomplish. Reference related GitHub issues and PRs that help with the review.

Ray==2.46.0 discover some security vulnerabilities, including unauthorized default states and arbitrary code execution, as follows:

• GHSA-gx77-xgc2-4888
• GHSA-q279-jhrf-cc6v

This PR is committed for removing ray version restriction for requirements-npu.txt.

Checklist Before Starting

• Search for similar PRs. Paste at least one query link here: ...
• Format the PR title as [{modules}] {type}: {description} (This will be checked by the CI)
  • {modules} include fsdp, megatron, sglang, vllm, rollout, trainer, ci, training_utils, recipe, hardware, deployment, ray, worker, single_controller, misc, perf, model, algo, env, tool, ckpt, doc, data
  • If this PR involves multiple modules, separate them with , like [megatron, fsdp, doc]
  • {type} is in feat, fix, refactor, chore, test
  • If this PR breaks any API (CLI arguments, config, function signature, etc.), add [BREAKING] to the beginning of the title.
  • Example: [BREAKING][fsdp, megatron] feat: dynamic batching

Test

For changes that can not be tested by CI (e.g., algorithm implementation, new model support), validate by experiment(s) and show results like training curve plots, evaluation results, etc.

Not related.

API and Usage Example

Demonstrate how the API changes if any, and provide usage example(s) if possible.

Not related.

Design & Code Changes

Demonstrate the high-level design if this PR is complex, and list the specific changes.

Not related.

Checklist Before Submitting

Important

Please check all the following items before requesting a review, otherwise the reviewer might deprioritize this PR for review.

• Read the Contribute Guide.
• Apply pre-commit checks: pre-commit install && pre-commit run --all-files --show-diff-on-failure --color=always
• Add / Update the documentation.
• Add unit or end-to-end test(s) to the CI workflow to cover all the code. If not feasible, explain why: ...
• Once your PR is ready for CI, send a message in the ci-request channel in the verl Slack workspace. (If not accessible, please try the Feishu group (飞书群).)

[gemini-code-assist]

Code Review

This PR updates the ray dependency in requirements-npu.txt to address security vulnerabilities by removing the version pin. While this is a valid approach to resolve the security issue, it can lead to non-reproducible builds and potential future compatibility problems. I have added a suggestion to specify a minimum version for ray, which is a safer practice that improves stability and aligns with other dependency files in this repository.