Harden tool authorization: sensitive settings, deferred ops, copy/move patterns

[rtfeldman]

This PR hardens the authorization flow for all file and directory tools.

Sensitive settings protection

All file/directory tools (copy, move, create_directory, delete, save, edit, streaming_edit) now detect and protect sensitive settings paths:

• Paths inside .zed/ directories (local settings)
• Paths inside the global config directory (~/.config/zed/ or equivalent)

Even when the global default is allow, modifications to these paths require explicit confirmation. The authorization dialog title is annotated with "(local settings)" or "(settings)" to inform the user.

sensitive_settings_kind walks up ancestor directories to handle paths where intermediate subdirectories don't exist yet (e.g. ~/.config/zed/new_subdir/evil.json).

Deferred filesystem operations

Copy, move, create_directory, and delete tools now defer all project/filesystem operations until after the user authorizes the action. Previously, some tools began resolving project paths or traversing directories before authorization.

streaming_edit_file permissions

streaming_edit_file now shares edit_file's tool name for permission checks, ensuring consistent permission rules between the two edit tool variants. The duplicated authorization logic is replaced by a shared authorize_file_edit function.

Copy/move pattern extraction

Copy and move tools now include both source and destination paths in their permission context (input_value). The always-allow pattern is extracted from the common parent directory of both paths, ensuring the pattern covers future checks against both.

Save tool improvements

• Authorization title now shows only the paths that need confirmation, not all paths
• Title is annotated with "(local settings)" or "(settings)" for sensitive paths

Release Notes:

• File and directory tool operations now require confirmation before modifying sensitive settings paths.