feat: add network filtering with domain restrictions (#22)

* fix: remove config override logging to prevent API key exposure

* feat: add network filtering with domain restrictions

- Add --domains flag to restrict container network access to specific domains/ports
- Integrate monadicalsas/network-filter container for network isolation
- Support domain patterns like 'example.com:443', '*.api.com'
- Add defaults.domains configuration option
- Automatically handle network-filter container lifecycle
- Prevent conflicts between --domains and --network options

* docs: add --domains option to README usage examples

* docs: remove wildcard domain example from --domains help

Wildcard domains are not currently supported by network-filter

README.md

@@ -98,6 +98,9 @@ cubbix /path/to/project
 # Connect to external Docker networks
 cubbix --network teamnet --network dbnet
 
+# Restrict network access to specific domains
+cubbix --domains github.com --domains "api.example.com:443"
+
 # Connect to MCP servers for extended capabilities
 cubbix --mcp github --mcp jira