feat: add credential_process allowlist for profile registry

[sbldevnet]

Problem

The profile registry feature allows registry administrators to set arbitrary credential_process values in synced profiles. An attacker with write access to a registry repository could inject a malicious command that executes whenever the AWS CLI resolves credentials for that profile.

Solution

Add an AllowedCredentialProcesses option to the [ProfileRegistry] config in ~/.granted/config. During registry sync, any profile whose credential_process value does not match an entry in the allowlist is skipped with a warning and never written to ~/.aws/config.

When no allowlist is configured, only granted credential-process is permitted. Organizations with custom credential helpers can explicitly allow them:

[ProfileRegistry]
AllowedCredentialProcesses = [
  "granted credential-process",
  "/usr/local/bin/company-cred-helper",
]

Example

registry add:

❯ dgranted registry add -name debug -u git@github.com:sbldevnet/granted-registry.git -f debug.yml
[i] Cloning into '/Users/sbldevnet/.dgranted/registries/debug'...
[!] skipping registry profile "debug1": credential_process not in allowlist ("/bin/sh -c 'unauthorized-command'")

registry sync:

❯ dgranted registry sync
[i] From github.com:sbldevnet/granted-registry
[i]  * branch            HEAD       -> FETCH_HEAD
[!] skipping registry profile "debug1": credential_process not in allowlist ("/bin/sh -c 'unauthorized-command'")