Update docs to detail actual required permissions

[jsejcksn]

Now that denoland/deno#15339 has landed, the --allow-run permission can be restricted (previously it had to be unbounded to terminate the subprocess). It should be possible to identify the actual minimum permissions and update the documentation and associated examples to detail them instead of showing --allow-all/-A.

For prior context/discussion, see denoland/deno#3378.