FileExplorer tool allows arbitrary file reads without path restrictions (security vulnerability)

#### Summary
The `FileExplorer` tool (`gemma.gm.tools._file_explorer.FileExplorer`) is marked as "read-only" but has **no path restrictions**. It can read **any file or directory** accessible to the process, including sensitive system files, SSH keys, environment files, and user credentials.

This is a **serious security vulnerability** when used in tool-using LLM agents, as an attacker could potentially exfiltrate sensitive data by prompting the model to read arbitrary files.

#### Affected Code
- `gemma/gm/tools/_file_explorer.py`
- `FileExplorer.call()` method accepts any path without validation
- No sandbox restrictions
- No blocking of sensitive system or home directory paths

#### Security Impact
The vulnerability allows:
- **Credential theft**: SSH keys (`~/.ssh/*`), API tokens, passwords stored in config files
- **System information disclosure**: `/etc/passwd`, system configuration files
- **Privacy violations**: User data, personal files, environment variables
- **Data exfiltration**: Any file readable by the process can be accessed

#### Steps to Reproduce
1. Create a `OneShotToolManager` with `FileExplorer` tool:
```python
from gemma.gm.tools import _file_explorer
from gemma.gm.tools import _manager

manager = _manager.OneShotToolManager(tools=[_file_explorer.FileExplorer()])
```

2. Attempt to read sensitive files via tool call:
```python
# Attack scenario 1: Read home directory
tool_call = '{"tool_name": "fileexplorer", "method": "ls", "path": "/home/user"}'
result = manager.maybe_execute_tool(tool_call)
# Returns directory listing exposing sensitive filenames

# Attack scenario 2: Read SSH config
tool_call = '{"tool_name": "fileexplorer", "method": "cat", "path": "/home/user/.ssh/config"}'
result = manager.maybe_execute_tool(tool_call)
# Returns SSH configuration with sensitive data

# Attack scenario 3: Read system file
tool_call = '{"tool_name": "fileexplorer", "method": "cat", "path": "/etc/passwd"}'
result = manager.maybe_execute_tool(tool_call)
# Returns system user database
```

3. All three scenarios successfully expose sensitive data.

#### Expected Behavior
The `FileExplorer` tool should:
- Restrict file access to a configurable sandbox directory
- Block access to sensitive system paths (`/etc`, `/usr`, `/root`, etc.)
- Block access to sensitive home directory paths (`~/.ssh`, `~/.bashrc`, etc.)
- Return clear error messages when access is denied

#### Actual Behavior
The `FileExplorer` tool:
- Allows access to **any file** the process can read
- Has no path validation or restrictions
- Successfully reads sensitive files like SSH keys, system files, and user configs
- Exposes sensitive data in tool output

Start with gemma/gm/tools/_file_explorer.py and inspect FileExplorer.call(), then run the provided OneShotToolManager reproductions for home, SSH, and system paths. Define the permitted sandbox and denial behavior before changing access checks; done means paths outside the configured boundary and the listed sensitive locations are rejected with clear errors.

Written by the indexing model from the issue text.