Add --no-clobber for explicit output files

DennisGaida raised accidental overwrites in Discussion #1976. I'd suggest an opt-in --no-clobber instead of changing the default or adding prompts.

With --output, the flag would fail without changing an existing destination, including symlinks, or exclusively create a new file. It would reject use without --output or with --in-place. Without the flag, behavior stays unchanged; shell redirection is outside this feature.

The explicit-output branches in cmd/sops/main.go currently use os.Create. Exclusive creation would avoid the race in a separate existence check.

I'd implement this across commands supporting --output, including legacy syntax, with tests for unchanged existing bytes and invalid combinations. Does this approach fit SOPS?