feat: always ask for approval for non-readonly commands

[droot]

Two big changes related to command approval flow.

• Do not rely on LLM to determine if a command modifies resource or not.
• If LLM suggests a composite command such as kubectl get pods | wc -l or generic bash script command multiple commands, we will always ask for approval even if the kubectl commands are readonly (this is to avoid exfilteration attacks).

Why

We are seeing requests for using the tool against production clusters and without the above changes, I see a serious risk of prompt injection attacks.

It may appear that the above changes may cause prompt fatigue because it will ask the user to approve commands but majority of the use-cases involves read-only kubectl commands and our current static filter will cover those pretty well and not request user to approve those commands.

Follow ups (coming)

• Remove the "modifies_resource" parameter in the LLM call completely.
• Improve the system prompt to steer LLM to avoid using composite calls as much as possible when using kubectl.

fixes #449

[droot]

/cc @zvdy

[janetkuo]

/lgtm