Provide individual subcommands in approval policy

In addition to run.command, have another input value that is a list of the “subcommands”.

Specifically if the command is something like “command1; commad2 -option” or “command1 && command2 -option”, then you would get [“command1”, “command2 -option”].

This would make it a lot simpler to ensure the commands are in an allowlist, while still allowing multiple commands to be run at once.

Or alternatively, have a way to create a pipeline of multiple tasks to run in the same container, to avoid having to pay the cost of warming up a container for each command when you need to perform multilple tasks.