Add tap trust enforcement

- Store trust decisions in `var/homebrew/trust.json` so users can
  opt into tighter loading rules for third-party taps.
- Check formulae, casks and external commands before Ruby loads them
  when `HOMEBREW_REQUIRE_TAP_TRUST` is set.
- Keep the checks lazy for command lookup to avoid loading tap code at
  `brew` startup.