Custom settings entries now block more template tokens

What

• Validation of user-supplied settings entries (environment variables, allow/soft-deny/hard-deny rule proposals, and notes) now rejects a wider set of literal template tokens. Previously it only blocked <settings_...> and cc_automode markers; it now also blocks <user_allow_rules_to_replace>, <user_soft_deny_rules_to_replace>, <user_hard_deny_rules_to_replace>, and <user_environment_to_replace>.
• A new helper function classifies a string as a "template_token" (if it contains <settings_ or matches a list of known tag names) or a "region_tag" (if it contains <cc_automode or </cc_automode>), or neither.

Why

This closes gaps that could let a settings entry contain a placeholder token that gets mistaken for real content, and gives the validation logic a clearer way to tell template placeholders apart from automode region markers.