Add workflow expression security validation

[sezallagwal]

Summary

• Add security validation for workflow expressions
• Block unsafe JavaScript patterns from being used in workflow expressions
• Allow safe access to workflow steps, params, strings, arrays, and common helper methods
• Add support for automatically returning expression results when needed
• Provide reusable expression validation for composer and workflow logic

Depends on

#7

[dhairyashiil]

Hi Sezal, thanks for adding the expression security layer. Since this is the sandbox boundary, could we fix two things before this lands?

Could we block computed access to dangerous properties like constructor, prototype, and __proto__? Right now direct access is blocked, but an expression can still build the property name dynamically and reach those properties through computed access. That means a transform can mutate prototypes, which breaks the security guarantee this PR is trying to provide.

Could we also add acorn as a runtime dependency in the root package? expression-security.ts imports it at runtime, but the root package.json does not list it under dependencies. It is only present through dev tooling, so production installs can fail.

Also, npm run lint starts failing on this stack around this area, so could we clean that up here as well?

This is a strong direction, I just think the security boundary should be strict from the first version.