core: prevent codesearch and websearch tools when webfetch permission is denied