Feature Request: Add Directory-based File Access Control for `fs_read` in Amazon Q CLI

## Description
Currently, the `/tools untrust fs_read` command applies file access restrictions globally. This feature request proposes implementing granular, directory-based access control to provide a better balance between security and productivity.

## Current Behavior
- File access control is applied globally (all files either require permission or no files require permission)
- No way to specify directory-specific access controls
- Users must choose between unrestricted access or requiring permission for every file

## Proposed Behavior
Implement directory-based file access control with the following characteristics:
- Allow unrestricted file access within designated workspace/project directories
- Require explicit permission for file access outside workspace directories
- Configurable path-specific access controls

### Example Access Patterns:
- `/project-workspace/` → No permission required
- `/home/user/documents/` → Permission required
- `/etc/` → Permission required
- `/var/` → Permission required

## Use Case
This feature would benefit developers working in secure environments who need to:
- Work efficiently within their project directories without constant permission prompts
- Maintain security controls for system files and sensitive areas
- Have granular control over which directories require explicit permission

## Benefits
1. Enhanced security through more precise access control
2. Improved developer productivity within trusted workspaces
3. Better balance between security and usability
4. More flexible configuration options for different security requirements

## Documentation Reference
Current documentation: https://docs.aws.amazon.com/amazonq/latest/qdeveloper-ug/command-line-chat-security.html#command-line-chat-security-file-access

## Additional Context
This request comes from customer feedback in production environments where the current all-or-nothing approach to file access control is not optimal for their security and productivity needs.

Beginne mit dem dokumentierten Verhalten von `/tools untrust fs_read` in der verlinkten Sicherheitsdokumentation von Amazon Q CLI. Ermittle anschließend den CLI-Einstiegspunkt, der diesen Befehl und seine Dateizugriffsprüfungen verarbeitet. Lege fest, wie Regeln für Arbeitsbereiche und bestimmte Pfade konfiguriert und durchgesetzt werden sollen. Die Aufgabe ist abgeschlossen, wenn vertrauenswürdige Verzeichnisse keine Eingabeaufforderungen auslösen, während Dateien außerhalb dieser Verzeichnisse weiterhin eine ausdrückliche Berechtigung erfordern und das Verhalten durch geeignete Tests abgedeckt ist.

Vom Indexierungsmodell aus dem Issue-Text verfasst.