Bug/Feat: Sandbox config to selectively enable tools

### Describe the feature or problem you'd like to solve

Feature Request: Sandbox config in settings.json to selectively enable tools, and/or whitelist bundled copilot package tools

### Proposed solution

potentially have some tools { ... } within sandbox section in settings.json to enable allowed tools/apps/executables
_(or provide documentation on how best to accomplish this if fits somehow in current schema)_

more specifically, encountered this around copilot bundled rg ripgrep, while in sandbox enabled:
```
Search "xunit\.V3" (sandboxed) sh: 1:~/.copilot/pkg/linux-x64/1.0.75/ripgrep/bin/linux-x64/rg: not found

Search is blocked because the bundled  rg  executable is unavailable under the current sandbox policy.
Please review  /sandbox  and retry.
```

ideally specifically around this, executable packages that are bundled within distributed copilot are just marked "safe" by default and end user does not need to do anything additional to whitelist to allow these in sandbox mode

### Example prompts or workflows

_No response_

### Additional context

_No response_

先阅读 settings.json 配置和 /sandbox 策略行为，然后跟踪如何检查位于 ~/.copilot/pkg/linux-x64/1.0.75/ripgrep/bin/linux-x64/rg 的捆绑可执行文件。确定现有 schema 是否能够表示允许的工具，或者捆绑工具是否需要一个安全的默认值；当预期的配置或文档已定义，并且 sandboxed Search 可以使用 rg 时，即表示完成。

由索引模型根据 Issue 内容生成。