ad79246376
applyToolConfig() forcibly overrode the user's external_directory permission to 'allow' by placing OMO defaults after the user config spread. Reorder so defaults come first and user config spreads on top, allowing users to set 'ask' or 'deny'. The task permission remains forced to 'deny' after the spread for security. Closes #1973