feat: implement runcwd Defaults option

[Sim-hu]

Summary

Implements the runcwd sudoers Defaults setting (the Defaults equivalent of the CWD command tag), allowing admins to set the working directory policy globally instead of per-rule.

• Defaults runcwd=* permits --chdir for all commands (same as CWD=*)
• Defaults runcwd=/path sets a specific working directory
• Explicit CWD tags on command specs still take precedence
• Defaults !runcwd resets to default behavior

Closes #1448

Changes

• Add runcwd to the defaults! macro as an Option<Box<str>> text setting
• Store parsed ChDir in Judgement so the DirChange reference lifetime is correct
• Fall back to runcwd when no CWD tag is present on the matched command spec
• Core logic change is a single line: tag.cwd.as_ref() → tag.cwd.as_ref().or(self.runcwd.as_ref())

Test plan

• Unit test: runcwd direct manipulation on Judgement (runcwd=*, runcwd=/path, CWD override)
• Integration test: full sudoers parsing with Defaults runcwd=*, runcwd=/path, CWD override, and !runcwd negation
• Parser validation: Defaults runcwd = *, Defaults runcwd = /usr/local, Defaults !runcwd
• All existing sudoers tests pass (42/42)
• clippy clean

[squell]

Since runcwd is already a part of Settings, I would prefer to not have it duplicated here; I believe it can be fed into the tokens::ChDir::construct function further below. Otherwise things can get confusing.

[squell]

Integration tests are good, but they should go in the test-framework folder so they are also verified for compliance against original sudo. In any case, I find this particular test-case to be a bit "dense".

[squell]

The changes in defaults/mod.rs and the Judgement::authorization function are fine.

However, I would like to see:

• runcwd_defaults_integration_test to be replaced with a proper "full up" compliance test in the test-framework/ folder. As it stands this test looks rather complex (even though the addition of runcwd isn't too complex), and secondly an integration test can be expressed much more succinctly and provide more confidence over there.

• There's no need to add runcwd to the Judgement object.

Also, I don't know if LLM's were used to generate (parts of) this PR, but if so, take note of our stance on genAI.

[Sim-hu]

Addressed both points:

• Dropped the runcwd field from Judgement. It's now folded into tag.cwd in check() when no explicit CWD is set, so the existing ChDir::construct path handles it and policy.rs is back to plain tag.cwd.as_ref().
• Removed the in-tree integration test and added a compliance test instead (test-framework/.../sudoers/runcwd.rs, 3 cases). It passes against both original sudo (1.9.16) and sudo-rs.