Add gitTrackedOnly parameter to fs_read tool for git-aware file operations

### Checks

- [x] I have searched [github.com/aws/amazon-q-developer-cli/issues](https://github.com/aws/amazon-q-developer-cli/issues?q=) and there are no duplicates of my issue
- [x] I have run `q doctor` in the affected terminal session
- [x] I have run `q restart` and replicated the issue again

### Operating system

Linux 5.10.240-218.966.amzn2int.x86_64 - Amazon Linux 2

### Expected behaviour

The fs_read tool should support a gitTrackedOnly boolean parameter that restricts file operations to only files tracked by git in the repository. This would automatically respect .gitignore patterns and eliminate the need for extensive deniedPaths configuration.

### Actual behaviour

The current way to achieve this is to duplicate the folders from .gitignore in the deniedPaths for fs_read tool which is duplicating work. Also different git projects can have different .gitignore settings.

### Steps to reproduce

1. Use fs_read tool in a git repository
2. Notice it searches through .gitignore'd files and directories
3. Requires manual deniedPaths configuration in agent settings to exclude common patterns

### Environment

```yaml
[q-details]
version = "1.15.0"
hash = "a8a0426eaff32ac9b1599ca1b1f1881ffd16054d"
date = "2025-09-02T17:19:48.333498Z (12d ago)"

[system-info]
chip = "AMD EPYC 7R13 Processor"
total-cores = 8
memory = "30.66 GB"

[system-info.os.linux]
kernel_version = "5.10.240-218.966.amzn2int.x86_64"
id = "amzn"
name = "Amazon Linux"
pretty_name = "Amazon Linux 2"
version_id = "2"
version = "2"
variant = "internal"

[environment]
install-method = "toolbox"
in-ssh = true

[env-vars]
Q_SET_PARENT_CHECK = "1"
SHELL = "/bin/zsh"
TERM = "screen"

[chat-settings]

[chat-trusted_tools]
fs_read=trusted

[chat-failed_request_ids]
none

[chat-context]
profile_context=
README.md

files=none
```