Restrict go2rtc exec sources by default

[NickM-27]

Proposed change

go2rtc supports exec, expr, and echo sources which can be used to execute arbitrary code. This makes it particularly easy for an attacker to gain extra access and run arbitrary programs such as crypto miners once they have access to a user's config.

This PR makes it so the parser restricts these streams by default unless an env var is set to override that behavior, making it less likely that a user can be affected by this manner of attack.

Type of change

• Dependency upgrade
• Bugfix (non-breaking change which fixes an issue)
• New feature
• Breaking change (fix/feature causing existing functionality to break)
• Code quality improvements to existing code
• Documentation Update

Checklist

• The code change is tested and works locally.
• Local tests pass. Your PR cannot be merged unless tests pass
• There is no commented out code in this PR.
• UI changes including text have used i18n keys and have been added to the en locale.
• The code has been formatted using Ruff (ruff format frigate)

[netlify]

✅ Deploy Preview for frigate-docs ready!

Name	Link
🔨 Latest commit	9f9f023
🔍 Latest deploy log	https://app.netlify.com/projects/frigate-docs/deploys/695d21c066b1100008121d6c
😎 Deploy Preview	https://deploy-preview-21543--frigate-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.