Add configurable Python module lists via config directives

[nickdavies]

I wanted to be able to configure Python modules in preparation for enabling -c analysis. I'm not super familiar with the codebase so please let me know what you think of the approach. Happy to adjust to match any style etc.

Add python-allow-module and python-deny-module config directives so users can customize which Python modules are considered safe or dangerous during static analysis.

• Config: parse and validate module names (dotted identifiers only), accumulate across config layers, support inline comments
• SafetyAnalyzer: parameterize with extra_safe_modules/extra_deny_modules merged with hardcoded sets. Allow overrides exact matches in the dangerous list (submodules must be allowed separately).
• Thread Config through HandlerContext so python handler can access configured module lists.

Example .dippy config:
python-allow-module numpy python-allow-module pandas python-deny-module requests

[ldayton]

Thanks for this — and sorry for the long wait on review.

This is a clean, self-contained change. A few things I checked that made me comfortable merging it on its own:

• When no python-allow-module/python-deny-module is configured, behavior is byte-identical to before (empty sets), so there's no change for users who don't opt in.
• allow overriding the hardcoded dangerous list via exact-match set subtraction is correct — submodules like http.server stay denied because they're separate entries, so allowing http doesn't leak them (your test covers this).
• It's an opt-in user override, which fits the security model the same way allow … / set default allow already do.
• Merges cleanly onto current main and the full suite passes.

Merging. The -c analysis and secrets work (#134/#135) I'll follow up on separately.