feat(anta): Add support for command blacklist to secure tests

[titom73]

Description

Add support of a list of blacklisted regex to secure test execution and avoid
any critical change on devices.

It currently blocked CLI with following regex

• Reload command: ^reload\s*\w*
• Configure mode: ^conf\w*\s*(terminal|session)*
• Write: ^wr\w*\s*\w+

Fixes #413

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my code
• I have run pre-commit for code linting and typing (pre-commit run)
• I have made corresponding changes to the documentation
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes (tox -e testenv)

[gmuloc]

This implementation won't prevent a malicious device implementation (injecting reload / conf t / ... in its own _collect.

Wondering if we should not rather implement this in the AntaDevice(ABC) collect ?

[gmuloc]

This implementation won't prevent a malicious device implementation (injecting reload / conf t / ... in its own _collect.

Wondering if we should not rather implement this in the AntaDevice(ABC) collect ?

we keep it in test

[carl-baillargeon]

Tested a few blocked commands locally with collect of AntaTest and it works.

Should we add this guard to anta debug as well?

(.anta) ➜  anta git:(test_blacklist) anta debug run-cmd -c "configure terminal" -d DC1-LEAF1A --ofmt text
Run command configure terminal on DC1-LEAF1A

(.anta) ➜  anta git:(test_blacklist) anta debug run-cmd -c "write" -d DC1-LEAF1A
Run command write on DC1-LEAF1A
{'messages': ['Copy completed successfully.']}

[titom73]

Tested a few blocked commands locally with collect of AntaTest and it works.

Should we add this guard to anta debug as well?

(.anta) ➜  anta git:(test_blacklist) anta debug run-cmd -c "configure terminal" -d DC1-LEAF1A --ofmt text
Run command configure terminal on DC1-LEAF1A

(.anta) ➜  anta git:(test_blacklist) anta debug run-cmd -c "write" -d DC1-LEAF1A
Run command write on DC1-LEAF1A
{'messages': ['Copy completed successfully.']}

Ideas was to protect tests to send dangerous command while in debug mode, you do that on purpose. A complete protection of the device should be done via a correct RBAC configuration.

Adding this protection to anta debug can be done but in different manner than process in place for anta nrfu

[carl-baillargeon]

LGTM