CLI: skip exec SecretRef dry-run resolution unless explicitly allowed (#49322)

* CLI: gate exec SecretRef dry-run resolution behind opt-in

* Docs: clarify config dry-run exec opt-in behavior

* CLI: preserve static exec dry-run validation

src/cli/config-set-input.ts

@@ -5,6 +5,7 @@ export type ConfigSetOptions = {
   strictJson?: boolean;
   json?: boolean;
   dryRun?: boolean;
+  allowExec?: boolean;
   refProvider?: string;
   refSource?: string;
   refId?: string;