feat: restrict effectors

[kmd-fl]

Description

[Provide a brief description of the changes introduced by this pull request and the motivation behind them.]

Motivation

safe nox

Proposed Changes

• generate configs inside nox
• add new method to add module that doesn't accept config
• other methods still accept it, but use only the name
• make curl (from the config example) a default effector

Additional Notes

• System services still use the config from distro
• Marine configs are still stored when we add module distro (TODO: fix it)
• allowd_binaries in the peer info API now prints the list of paths used in effectors

Config example:

[effectors.curl]
wasm_cid = "bafkreids22lgia5bqs63uigw4mqwhsoxvtnkpfqxqy5uwyyerrldsr32ce"
  [effectors.curl.allowed_binaries]
  curl = "/usr/bin/curl"

or

[effectors.curl]
wasm_cid = "bafkreids22lgia5bqs63uigw4mqwhsoxvtnkpfqxqy5uwyyerrldsr32ce"
allowed_binaries = { curl = "/usr/bin/curl" }

New api

service Dist("dist"):
   add_module_bytes_from_vault(name: string, module_cid: string) -> string