Feature Request: Add Directory-based File Access Control for `fs_read` in Amazon Q CLI

## Description
Currently, the `/tools untrust fs_read` command applies file access restrictions globally. This feature request proposes implementing granular, directory-based access control to provide a better balance between security and productivity.

## Current Behavior
- File access control is applied globally (all files either require permission or no files require permission)
- No way to specify directory-specific access controls
- Users must choose between unrestricted access or requiring permission for every file

## Proposed Behavior
Implement directory-based file access control with the following characteristics:
- Allow unrestricted file access within designated workspace/project directories
- Require explicit permission for file access outside workspace directories
- Configurable path-specific access controls

### Example Access Patterns:
- `/project-workspace/` → No permission required
- `/home/user/documents/` → Permission required
- `/etc/` → Permission required
- `/var/` → Permission required

## Use Case
This feature would benefit developers working in secure environments who need to:
- Work efficiently within their project directories without constant permission prompts
- Maintain security controls for system files and sensitive areas
- Have granular control over which directories require explicit permission

## Benefits
1. Enhanced security through more precise access control
2. Improved developer productivity within trusted workspaces
3. Better balance between security and usability
4. More flexible configuration options for different security requirements

## Documentation Reference
Current documentation: https://docs.aws.amazon.com/amazonq/latest/qdeveloper-ug/command-line-chat-security.html#command-line-chat-security-file-access

## Additional Context
This request comes from customer feedback in production environments where the current all-or-nothing approach to file access control is not optimal for their security and productivity needs.

Inizia dal comportamento documentato di `/tools untrust fs_read` nella documentazione sulla sicurezza di Amazon Q CLI collegata, quindi individua il punto di ingresso della CLI che gestisce questo comando e i relativi controlli di accesso ai file. Definisci come devono essere configurate e applicate le regole per gli spazi di lavoro e per i percorsi specifici. Il lavoro è completato quando le directory attendibili non richiedono conferme, mentre i file al di fuori di esse richiedono ancora un’autorizzazione esplicita, e il comportamento è verificato da test appropriati.

Scritto dal modello di indicizzazione a partire dal testo della issue.