Return names of toolbox tools that require runtime approval.
This inspects the toolbox tools/list metadata and returns tool names
whose _meta.tool_configuration.require_approval value is "always".
This capability is independent from OAuth consent handling.
