Allow blessing specific tools

[miguelraz]

It's annoying to bless a specific tool run (e.g., cargo test) on every new agent thread.

We should add a feature that lets you specify specific blessed tools in a profile.

[miguelraz]

It would also be neat for organizations to set project-wide removal of Allow All to clamp run-away LLM cases.

[miguelraz]

#43220 Has been filed too.