Start enforcing the $PATH restrictions

Anything that isn't explicitly marked as Allowed in this list will now
return an error (and log a message) when it is executed.

Test: search all logs from the build server over the last day
Change-Id: I3ceacd9a140097809dde81a8d8979dd2c45f234c