Enforce custom agent subagent allowlists (#331442)

* Initial plan

* Add subagent allowlist tests

Co-authored-by: aeschli <6461412+aeschli@users.noreply.github.com>

* Enforce subagent allowlist

Co-authored-by: aeschli <6461412+aeschli@users.noreply.github.com>

* Fix run subagent test string quotes

Co-authored-by: aeschli <6461412+aeschli@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: aeschli <6461412+aeschli@users.noreply.github.com>
Co-authored-by: Martin Aeschlimann <martinae@microsoft.com>