Bash approvals can now auto-add a standing allow rule

Approving certain Bash calls can now silently create a persistent local allow rule. When keepsStandingApprovals is set on the input and the command is a clean, non-wildcard, single-line string under a length cap, the approval emits an addRules action that allows that exact command in localSettings.