Add a new boolean option 'trustdir' (default on) that prompts users to trust directories before applying modelines. When a file containing a modeline is opened, Vim asks whether to trust the directory permanently (saved to ~/.vim/trust.json), for the session only, or not at all. Parent directory inheritance is supported.

This is designed to be extensible to other features like 'exrc' in the future — trust.json stores per-directory permission flags:

[
  {"path": "/home/user/dev/vim", "modeline": true},
  {"path": "/home/user/projects", "modeline": true, "exrc": true}
]

Opening this as a draft to get feedback on the approach, especially from @chrisbra. #19875

Known concerns:

• Since 'trustdir' is enabled by default, some existing tests that rely on modeline processing may fail due to the trust prompt being triggered.
• Multiple Vim instances writing to trust.json concurrently could cause data loss (last writer wins). The write frequency is very low (only on user interaction), so the practical risk is minimal, but a file locking mechanism could be added if needed.
• The 'trustdir' option has the P_SECURE flag, so it cannot be changed via modeline.

Note: This pull request was created with the help of Claude Code.