fix(security): remove git from Deno sandbox allow-run (GHSA-gj6h-vw66-mr8f)

The `// sandbox` annotation restricts Deno to `--allow-run=git,/usr/bin/chromium`.
git can be coerced into spawning `/bin/sh` via hook configs such as
`git -c core.fsmonitor=<cmd> status`, and that subprocess is spawned by git —
not Deno — so it is invisible to Deno's permission model. This let any user
with script-execution permission run arbitrary OS commands as root inside the
worker, fully defeating the sandbox.

The advisory's alternative (injecting `-c core.fsmonitor=false -c
core.hooksPath=/dev/null`) does not apply here: the user's own script invokes
git directly via `Deno.Command`, so Windmill cannot inject hardening flags into
that call. Removing git from the allowlist is the only complete fix. git was
originally allowed for git-sync-adjacent use, which no longer needs it.

Verified with the advisory PoC: git invocation now returns
`Requires run access to "git"` and the sandbox escape is closed. chromium
(puppeteer) support is preserved.

Fixes WIN-2151

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

backend/windmill-worker/src/deno_executor.rs

@@ -481,7 +481,11 @@ try {{
             args.push("--allow-write=./");
             args.push("--allow-env");
             args.push("--allow-import");
-            args.push("--allow-run=git,/usr/bin/chromium");
+            // git is intentionally NOT in this allowlist: git can be coerced into
+            // spawning /bin/sh via hook configs (e.g. `-c core.fsmonitor=<cmd>`),
+            // which escapes Deno's permission model and defeats the sandbox
+            // (GHSA-gj6h-vw66-mr8f). Only allow the specific chromium binary.
+            args.push("--allow-run=/usr/bin/chromium");
         } else {
             args.push("-A");
         }