fix(gateway): tighten tools invoke HTTP guardrails (#57771)

* fix(gateway): tighten tools invoke HTTP guardrails

Co-authored-by: Brian Mendonca <208517100+bmendonca3@users.noreply.github.com>

* fix(security): centralize gateway HTTP deny defaults

* fix(gateway): drop duplicate scope guard after rebase

---------

Co-authored-by: Brian Mendonca <208517100+bmendonca3@users.noreply.github.com>

src/security/audit.test.ts

@@ -650,6 +650,17 @@ description: test skill
         },
         expectedSeverity: "critical",
       },
+      {
+        name: "newly denied exec override",
+        cfg: {
+          gateway: {
+            bind: "lan",
+            auth: { token: "secret" },
+            tools: { allow: ["exec"] },
+          },
+        },
+        expectedSeverity: "critical",
+      },
     ];
     await runConfigAuditCases(
       cases,