feat: add pattern-based external file access permission

[Mishkun]

I've vibed a solution for my issue (#3218). I thought it might be cool to have a more granular control, so added bash-like complex permission for external files.

Claude overview:

• Implements pattern-based external file access permission system (Feature request: ability to disable "File X is not in the current working directory" error #3218)
• Adds external_files permission with support for allow, ask, and deny modes
• Supports pattern-based control similar to bash permissions (e.g., */docs/*: "allow")
• Defaults to ask for security while enabling flexible configuration for monorepo workflows

Changes

Tool Updates

• Read Tool: Added permission check for files outside working directory
• Write Tool: Added permission check before file creation/modification
• Edit Tool: Added permission check for external file edits
• Patch Tool: Added permission check for all file operations in patches

Configuration Examples

Simple Permission

{
  "permission": {
    "external_files": "ask"
  }
}

Pattern-Based (Monorepo)

{
  "permission": {
    "external_files": {
      "*/docs/*": "allow",
      "*/packages/*/README.md": "allow",
      "*/node_modules/*": "deny",
      "*": "ask"
    }
  }
}

Per-Agent Configuration

{
  "agent": {
    "build": {
      "permission": {
        "external_files": "allow"
      }
    }
  }
}

Closes #3218

[Mishkun]

Oops, PR was meant to be a draft here. Need to check all of the functionality by hand

[Mishkun]

I'll provide new pr compatible with opentui migration