feat: prompt confirmation for fs write operations outside cwd

[sigoden]

FS_BASE_DIR does not work properly, see https://github.com/sigoden/llm-functions/pull/70#issuecomment-2265198017

We are changing to a new security policy:

• Always allow read operations.
• Always allow write operations that only affect the current directory.
• For other operations, prompt for confirmation.