Bash-tool deny-rule check now also screens read-only referenced paths

The permission check that screens file paths touched by a Bash command against deny rules (rules that block access to certain files) now checks two separate lists: the paths the command writes to or otherwise operates on, and a new, optional list of paths that are only read, such as files referenced by an awk/gawk getline call. The read-only list is checked specifically under the 'read' permission verb.