fix: validate commands against allowed/denied lists before execution

- Add validation in executeCommandTool to check commands against user-configured allowed and denied command lists
- Denied commands take precedence over allowed commands
- Empty command strings in lists are ignored
- Add comprehensive tests for command validation scenarios
- Fixes #5997 where Roo executed commands outside the allowed command set

Author: roomote