Add terminal sandbox write allow list

[dileepyavan]

fixes #313796

[Copilot]

Pull request overview

This PR extends the terminal sandbox configuration generation to support a command-specific write allow-list, and uses it to permit Node-related commands to write into ~/.volta/ while keeping the default sandbox config unchanged until command keywords are parsed.

Changes:

• Add a new terminalSandboxWriteAllowList.ts helper that maps parsed command keywords to write-allowed paths.
• Update TerminalSandboxService to incorporate command-specific write allow-list paths into filesystem.allowWrite (and thus into allowRead via the existing “allowWrite implies allowRead” behavior).
• Extend existing unit tests to validate the presence/absence of ~/.volta/ in allowWrite before/after parsing Node vs Git command keywords.

Show a summary per file

File	Description
src/vs/workbench/contrib/terminalContrib/chatAgentTools/test/browser/terminalSandboxService.test.ts	Adds assertions covering command-specific write allow-list behavior for Node vs Git keywords.
src/vs/workbench/contrib/terminalContrib/chatAgentTools/common/terminalSandboxWriteAllowList.ts	Introduces keyword→operation mapping and operation→write-paths resolution (currently for Node, allowing ~/.volta/).
src/vs/workbench/contrib/terminalContrib/chatAgentTools/common/terminalSandboxService.ts	Wires the new write allow-list into sandbox config generation and renames the cached keyword list to reflect broader use.

Copilot's findings

• Files reviewed: 3/3 changed files
• Comments generated: 0