Tool-qualified deny

Permission pattern blocking a tool based on argument values, e.g., `Read(file_path:*.env*)` to prevent reading secrets files.