Constrain config skip permissions

[helly25]

Make configuration admission and skip authorization explicit, revocable, and scoped to the configuration source that owns each decision. Combined and granular skip requests no longer accidentally authorize one another, while named config sets can control whether explicit xffrc files are accepted.

AG;DR

• Preserve --no-config as a distinct combined request instead of irreversibly reducing it to the two granular booleans.
• Add system-global --allow-no-config / --no-allow-no-config; this pair governs only --no-config.
• Add system-global --allow-no-system-config / --no-allow-no-system-config; this pair governs only --no-system-config.
• Add --allow-no-user-config / --no-allow-no-user-config; the system decision is authoritative, otherwise the user file may decide whether --no-user-config is permitted.
• Parse system file-global controls before the first INI section. Require skip-permission controls before the first system section or user selector block.
• Treat each positive/negative skip-permission pair as one logical setting and permit it at most once in each applicable automatic config file.
• Reject every skip-permission control from explicitly selected --xffrc files.
• Add config-selectable --allow-xffrc / --no-allow-xffrc. These are ordinary config-only settings usable in system defaults or any user config block; normal selection and precedence decide whether command-line --xffrc=FILE is accepted.
• Keep the system policy gate authoritative: it may prevent a user block from enabling xffrc.
• Prevent an explicit xffrc file from admitting itself.
• Keep all config-only controls out of the resolved runtime option stream.
• Split config-control location validation into focused helpers so the policy remains within the enforced cognitive-complexity limit.
• Update the end-to-end explanation test to place user skip permission before selector blocks and exercise its matching granular request.
• Update generated help, XFF.md, and the changelog.

Validation:

• bazel test //xff/config:ini_test //xff/config:loader_test //xff/config:policy_test //xff/config:config_test --config=clang
• bazel test //xff/config:policy_test //xff/config:config_policy_fuzz_test --config=clang
• bazel test //xff/cli:explain_test --config=clang --test_output=errors
• Earlier focused generated-help suite passed; generated XFF.md was regenerated after the final wording and matches its generated artifact.
• Focused pre-commit checks passed.
• git diff --check
• Clang-tidy is intentionally left to CI because the current local machine configuration cannot sustain it.

A separate follow-up will add registry-backed repetition metadata and report unnecessary overriding settings within individual config sections. Deliberately accumulating settings and command-line repetitions remain unaffected.