fix: harden forbidden patterns config parsing and empty-pattern edge case

- Add tool_description_forbidden_patterns to _normalize_env_list_vars()
  and _parse_list_from_env() for CSV/empty-string env var robustness
- Filter empty/blank patterns at config validation time via
  _filter_empty_forbidden_patterns() to prevent '' in v matching everything
- Add runtime guard in validate_description() to skip empty patterns
- Regenerate docs/config.schema.json to include new settings
- Add tests for empty-pattern edge case and config-level filtering

Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

Author: crivetimihai