Remove tailwindcss from the default security.exec.allow list #15178

We enabled Node.js permission model in Hugo v0.161.0. This hardened the security for most of the JS tools that we support (e.g. PostCSS). Unfortunately, TailwindCSS needs a very permissive setup to run. Our runtime security model calls for pragmatic, but strict defaults. With that in mind, we need to remove tailwindcss from the default allow list.

Note that you can easily re-add this to your hugo.toml, e.g:

  [security.exec]
    allow = ['^((dart-)?sass|go|npx|babel|node|git|postcss|tailwindcss)$']

Note that TailwindCSS is perfectly safe to use if you own/trust your theme to now do harmful things.