macOS sandbox-exec config for Claude Code that restricts filesystem READ access for enhanced security