Merge pull request #2901 from d2lang/security/local-resource-policy

security: require explicit local file access