Fix docs-impact-review CI hitting max turns limit (#35744)

* Fix docs-impact-review hitting max turns by adding filesystem tools

The claude-code-action workflow instructs Claude to search ./docs/source/
for existing documentation, but only grants gh and MCP tools. Claude
repeatedly attempts filesystem access, gets denied, and exhausts the
30-turn limit. Add find, grep, cat, and ls to --allowedTools so the
docs checkout can actually be searched.

* Harden docs-impact-review against prompt-injection exfiltration

- Drop find from allowedTools (unsafe due to -exec)
- Scope ls, cat, grep to ./docs/source* paths only
- Add persist-credentials: false to both checkout steps to
  prevent token extraction from .git/config

* Use built-in Read/Glob/Grep tools instead of scoped Bash wrappers

Built-in tools cannot execute commands, chain via shell operators,
or abuse flags like -exec, making them inherently safer than any
Bash glob pattern for filesystem access.

.github/workflows/docs-impact-review.yml

@@ -22,6 +22,8 @@ jobs:
     steps:
       - name: Checkout PR code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Checkout documentation repo
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -29,6 +31,7 @@ jobs:
           repository: mattermost/docs
           ref: master
           path: docs
+          persist-credentials: false
           sparse-checkout: |
             source/administration-guide
             source/deployment-guide
@@ -200,7 +203,7 @@ jobs:
           claude_args: |
             --model claude-sonnet-4-20250514
             --max-turns 30
-            --allowedTools "Bash(gh pr diff*),Bash(gh pr view*),mcp__github_inline_comment__create_inline_comment"
+            --allowedTools "Bash(gh pr diff*),Bash(gh pr view*),Read,Glob,Grep,mcp__github_inline_comment__create_inline_comment"
 
       - name: Manage docs/needed label
         if: ${{ steps.docs-analysis.outcome == 'success' }}