fix: lock down allow-run permissions more (#25370)

`--allow-run` even with an allow list has essentially been
`--allow-all`... this locks it down more.

1. Resolves allow list for `--allow-run=` on startup to an absolute
path, then uses these paths when evaluating if a command can execute.
Also, adds these paths to `--deny-write`
1. Resolves the environment (cwd and env vars) before evaluating
permissions and before executing a command. Then uses this environment
to evaluate the permissions and then evaluate the command.

1 files changed, 5 insertions, 0 deletions

diff --git a/tests/specs/permission/write_allow_binary/__test__.jsonc b/tests/specs/permission/write_allow_binary/__test__.jsonc
new file mode 100644
index 000000000..a47fed572
--- /dev/null
+++ b/tests/specs/permission/write_allow_binary/__test__.jsonc
@@ -0,0 +1,5 @@
+{
+  "tempDir": true,
+  "args": "run -A main.ts",
+  "output": "main.out"
+}