Security screen: flag-as-approval, unique per-input approval ids, stale-context age cap (#611)

* security screen: flag-as-approval with unique per-input approval ids, stale-context age cap, classifier dedupe

* lint: drop unused ThreadMessage import

---------

Co-authored-by: Josh France <josh@ycombinator.com>