core: add potentially dangerous command check (#4211)

Certain shell commands are potentially dangerous, and we want to check
for them.
Unless the user has explicitly approved a command, we will *always* ask
them for approval
when one of these commands is encountered, regardless of whether they
are in a sandbox, or what their approval policy is.

The first (of probably many) such examples is `git reset --hard`. We
will be conservative and check for any `git reset`

codex-rs/core/src/command_safety/mod.rs

@@ -1,3 +1,4 @@
+pub mod is_dangerous_command;
 pub mod is_safe_command;
 #[cfg(target_os = "windows")]
 pub mod windows_safe_commands;