[3008.x] Add whitelist_state_modules minion option

[dwoz]

What does this PR do?

Adds a new whitelist_state_modules minion option that restricts which state modules the state loader will load, complementing:

• whitelist_modules — gates execution modules on the wire
• renderer_whitelist — gates renderers

Motivation

whitelist_modules prevents wire callers from invoking non-permitted execution modules (salt <tgt> cmd.run 'id' is denied), but an SLS author with write access to the state tree can still write:

run_shell:
  cmd.run:                # <-- STATE module named cmd, function run
    - name: id

…and state.apply executes it unconditionally. For VCF-style hardening the operator needs a symmetric control over which state modules are loadable.

Design (minimal — single feature)

• New opt whitelist_state_modules: [test, file, pkg, service, ...] in minion config. Case-sensitive module-name (not function-name) allowlist. Unset / empty list = no filtering (backward compat).
• salt.loader.states now reads the opt when the caller doesn't pass an explicit whitelist= kwarg, mirroring salt.loader.minion_mods's pattern for whitelist_modules.
• The value flows through to the underlying LazyLoader as whitelist= unchanged; LazyLoader._load already enforces the gate.
• SLS referencing a non-whitelisted state module fails per-chunk with {"result": False, "comment": "Specified state '...' was not found", "changes": {}} — no silent execution.
• whitelist_modules and whitelist_state_modules are strictly orthogonal.

Diff scope

File	Change
salt/loader/__init__.py	states() reads opts["whitelist_state_modules"] when whitelist not passed.
salt/config/__init__.py	New whitelist_state_modules: list type entry + [] default in DEFAULT_MINION_OPTS.
conf/minion	New commented-out example directly below whitelist_modules.
changelog/vcops-90587-state-whitelist.added.md	One-line changelog (rename to <PR#>.added.md after review).

Total: ~30 lines of code + docs, 4 tests.

Test coverage (three tiers, no unit-only)

Tier	File	Tests
Unit	tests/pytests/unit/loader/test_state_whitelist.py	4
Functional	tests/pytests/functional/loader/test_state_whitelist.py	8
Integration	tests/pytests/integration/states/test_whitelist.py	4

The integration tier boots a real salt-master + salt-minion pair, dispatches state.apply from the wire, and verifies both the allow path and the deny path — including a canary-file check to prove the non-whitelisted cmd.run state does NOT silently execute.

Merge requirements satisfied?

• Docs — commented example in conf/minion, docstring update on salt.loader.states.
• Changelog — changelog/vcops-90587-state-whitelist.added.md (rename to <PR#>.added.md after review).
• Tests written — unit + functional + integration, 16 new.

Commits signed with GPG?

No — DCO sign-off only (Signed-off-by: trailer).

Relation to PR #70192

Independent of PR #70192 (whitelist_modules two-loader completion). This PR is strictly additive; the two overlap on salt.loader.states()'s function signature and can be rebased if #70192 merges first.

[dwoz]

Rebase left a stray blank line in salt/loader/__init__.py:1205 that Pre-Commit (black) tripped on. Squashed the fix back into the single commit; force-pushed f41f504f8d4.

The remaining integration test failures on salt-ssh --relenv state.* variants are the same pre-existing Failed to spawn the VT. Error: [Errno 7] Argument list too long: '/usr/bin/ssh' ARG_MAX bug that hits every open PR — not caused by this change. Twangboy's #70194 is the fix.