🔒 Fix missing capability checks in std.socket network operations

[Tcode-Motion]

🎯 What: The vulnerability fixed
Missing sandbox enforcement in std.socket allowed scripts to bypass security restrictions. TcpStream::connect and TcpListener::bind were being executed without verifying if the executing context had the Capability::Network permission.

⚠️ Risk: The potential impact if left unfixed
A malicious script running in a restricted sandbox could bypass the security policy to establish outbound network connections or bind to local ports, leading to potential data exfiltration or unauthorized network interactions.

🛡️ Solution: How the fix addresses the vulnerability
Introduced explicit capability checks in stdlib/src/socket.rs for both connect and listen standard functions. If ctx.config.capabilities.contains(&Capability::Network) evaluates to false, a RuntimeError of type InvalidOperation indicating a security policy violation is returned. The capability was also added to the module's required_capabilities list, and tests were added to confirm the security sandbox enforcement behaves correctly in both privileged and unprivileged scenarios.

---

PR created automatically by Jules for task 9655494105280129390 started by @Tcode-Motion

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.