fix(@angular/cli): restrict MCP workspace access to allowed client roots during resolution

Introduces validation during workspace and project resolution to ensure the resolved
workspace path falls within the allowed MCP roots defined by client capabilities.
Throws an error if the workspace resolves outside the allowed roots.

Closes #33077