[Security hardening] Require explicit opt-in for shell workflow steps

[PascalThuet]

Summary

• Require workflows with shell steps to declare requires.permissions.shell: true.
• Detect shell steps recursively across conditional, switch, loop, and fan-out nesting.
• Block direct execution of shell workflows without the permission and document the new opt-in.

Security context

Shell workflow steps execute local commands via the shell. This makes that capability an explicit workflow permission instead of an implicit behavior.

Closes #2440

Validation

• git diff --check
• uvx ruff check src/specify_cli/workflows/engine.py tests/test_workflows.py
• uv run pytest tests/test_workflows.py -q