Make clause security check pluggable

[qqxhb]

Summary

• add ClauseChecker hook with ErrClauseNotHandled fallback behavior
• centralize clause validation with optional custom checker
• add tests for custom checker behavior

Tests

• go test ./...

[propel-code-bot]

It also wires the configurable checker into DO.Clauses and centralizes fallback handling in a helper to preserve the existing default behavior unless overridden.

Affected Areas

• do_options.go
• sec_check.go
• do.go
• do_clause_checker_test.go

This summary was automatically generated by @propel-code-bot

[propel-code-bot]

LGTM, ship it! 🚢

Details

Why was this auto-approved?

✅ APPROVED: No issues detected.

[qqxhb]

--delete-branch