Revert DEFAULT_APPROVE to just fs_read

- Keep resource in NATIVE_TOOLS but not in DEFAULT_APPROVE
- Agent config in ~/.aws/amazonq/cli-agents needs to be updated manually
- Users can add 'resource' to their agent's allowed_tools list

Author: kennvene-aws

crates/chat-cli/src/cli/chat/tools/mod.rs

@@ -53,7 +53,7 @@ use crate::cli::agent::{
 use crate::cli::chat::line_tracker::FileLineTracker;
 use crate::os::Os;
 
-pub const DEFAULT_APPROVE: [&str; 2] = ["fs_read", "resource"];
+pub const DEFAULT_APPROVE: [&str; 1] = ["fs_read"];
 pub const NATIVE_TOOLS: [&str; 7] = [
     "fs_read",
     "fs_write",