Allow null device redirection in path scope

[hiSandog]

Summary

• allow WorkspacePathScope to treat /dev/null as a null-device sink instead of an out-of-workspace path
• add coverage for echo ok >/dev/null

Validation

• python3 -m unittest tests.test_security_scope
• python3 -m unittest discover tests

[1716775457damn]

LGTM on the approach. Treating /dev/null as a null-device sink in path scope makes sense since it's a side-effect-free operation. One suggestion: consider documenting this behavior clearly in the security scope docs so users understand why /dev/null is exempt from path restrictions.