Block additional unvalidated argument types from shell actions, enforce
full-string custom regex matching, and allowlist http/https URL schemes.
Update checkbox integration test to use exec, matching the intended shell
vs exec split for choiceless checkbox arguments.
Co-authored-by: Cursor <cursoragent@cursor.com>
jamesread