[FEAT] Add deterministic pre-action authorization at the tool-call hook level

Is your feature request related to a problem? Please describe.

VoltAgent's guardrail system validates content but doesn't deterministically authorize tool execution before it happens. With MCP servers proliferating, agents face silent injection risks where a poisoned prompt triggers unintended tool calls. The Open Agent Protocol (OAP) provides a before_tool_call hook that checks every execution against a declarative policy - agent identity, capability boundaries, and rate limits enforced at the framework level, not prompt level. Given VoltAgent's existing lifecycle hooks and Zod-typed tools, adding OAP support would be a minimal wrapper that unlocks enterprise security compliance. Reference implementation: https://github.com/aporthq/aport-agent-guardrails - DOI: 10.5281/zenodo.18901596

Describe alternatives you've considered

No response

Additional context

No response

Describe the thing to improve

Provide an option which when set wraps tool.execute() with before_tool_call hook that validates against a Local (Not external API call passport and policy) or Hosted pre-action auth (~50ms latency) before execution; adds passport context (agent identity + capabilities) to every tool call.

If this is something that is aligned with the roadmap, happy to open a contained PR for your review.