Function validate_allowed_command 

pub fn validate_allowed_command(program: &str, allowed: &[String]) -> Result<()>

Validate that a command is in the allowed list.

Extracts the basename from the command path (e.g. /usr/bin/node → node) and checks if it’s in the allow list.