Enforce trust levels on resource reads

[HT154]

• Add pkl.Command#Read class to trigger dynamic reads not subject to trust level checks during command option parsing.
• Switch pkl.Base#Module to read the pkl.outputFormat property via a local external property since this is otherwise a trust level violation.

TODO:

• test that untrusted reads fail
• test that pkl.Command#Read works as expected
• consider feature flagging and/or warn/enforce strategy/timing for this change
• address existing problematic (converter) modules in pkl-pantry

Resolves #1645