Make whitelist_modules only apply to remote dispatch

[dwoz]

Closes #69983

What this changes

Splits the minion module loader into two views of the same set of modules:

• An outer, whitelist-filtered loader used for wire dispatch. A minion
  with whitelist_modules: [test, mycompany, saltutil] will refuse a
  remote publish of any module not in that list.
• An inner, unfiltered loader that is packed as __salt__ inside every
  loaded module. So mycompany.deploy can still do __salt__["cmd.run"](...)
  internally even when cmd is off the whitelist.

Combined with the existing per-command cmd_blacklist_glob, this gives a
useful defense-in-depth story for minions that don't fully trust the master:

• Whitelist [test, mycompany, saltutil, cmd] off → master can't publish
  arbitrary cmd.run calls
• cmd_blacklist_glob: ["*rm -rf*"] → even calls that reach cmd (through
  internal composition or if cmd is later whitelisted) refuse specific
  dangerous strings

Adjacent fixes

• salt/modules/saltcheck.py: moves the __context__["global_scheck"] = None
  initialisation out of module-level code and into __init__(opts) with
  setdefault. The old pattern re-ran on every exec_module and clobbered
  state that a running function had already set — exposed by the two-loader
  work above, but a pre-existing violation of the __context__ usage the
  developing-modules docs prescribe (check-then-populate).
• salt/utils/optsdict.py: caches the per-key DictProxy/ListProxy
  instead of allocating a new one on every read. opts["grains"] drops from
  413 ns to 208 ns per read; no allocation churn on hot loops.

Tests

New:

• tests/pytests/integration/loader/test_module_whitelist_dunder.py — 5
  tests covering direct-wire block, whitelisted-module reaches
  non-whitelisted via __salt__, and SLS render still respects whitelist
• tests/pytests/integration/renderers/test_renderer_whitelist.py — 2
  tests for the renderer_whitelist setting (defense in depth against
  #!py in SLS)

Broader-slice local run (tests/pytests/unit/loader/,
tests/pytests/functional/loader/, tests/pytests/integration/{loader,renderers,minion,states}/,
tests/pytests/functional/modules/state/, tests/integration/modules/test_saltcheck.py):
401 passed, 23 skipped, 1 unrelated env-permission failure
(test_directory_recurse calls chown -h nobody as unprivileged user).

Historical context

• Disabling cmd module causes connection error to master #52592 (2019) and Disabling CMD module on minion #25854 (2015) both closed with "many parts of Salt use
  the cmd module, you can't disable it" — this PR removes that constraint
  for the whitelist path.
• Whitelist for bluecoat (reverse of disable_modules support) #35609 (2016) was the original ask that led to whitelist_modules; this
  PR delivers what that feature was supposed to do.
• Discussion Actual behavior of `__context__` for execution modules? #67004 flagged a related but distinct __context__ semantics
  gap; the saltcheck fix here aligns with the documented pattern but does
  not attempt to close the broader persistence question.