Require confirm before reading credential files via MCP

[jasperf]

Summary

• ssh_command's read-only allowlist (cat, grep, head, tail, ...) let a credential-bearing file (wp-config.php, an SSH private key, .env) be read with no confirm: true step, since the command is harmless in general even when the argument isn't.
• wp_cli's read-only check treated wp config get DB_PASSWORD as safe too, for the same reason — get is a safe verb in general, but wp config is WP-CLI's direct interface onto wp-config.php's constants.
• Both now require confirm: true (the same human-approval flow every other sensitive MCP op already uses) when a credential-shaped path or the config command is involved. Nothing is blocked — legitimate reads/edits still go through, they just need the same explicit approval step as a write.

Why

Prompted by a LinkedIn discussion (Remkus de Vries' post and a comment on it) about MCP connections carrying broad, undifferentiated permissions to a WordPress site. Checked our own ssh_command/wp_cli tools against that exact scenario and found this gap.

Testing

• npx tsc --noEmit in mcp-server/ — clean, no type errors.
• No existing test suite in mcp-server/ to extend (no test script/files present).

CHANGELOG bumped to 5.20.1 under ### Security.