Configuration: Support YAML anchors and aliases in .herb.yml

[matiasleidemer]

Summary

Fixes #1631 — Herb::Configuration#load_config raises Psych::AliasesNotEnabled at runtime when .herb.yml uses YAML anchors and aliases.

The fix is a one-character addition: pass aliases: true to YAML.safe_load_file. Added a regression test that exercises the anchor/alias case end-to-end through Herb::Configuration.load.

Rationale

Psych.safe_load defaults aliases: false to mitigate the "billion laughs" DoS against untrusted YAML. But .herb.yml is developer-authored local config — same trust model as database.yml, credentials.yml, and .rubocop.yml, all of which enable aliases. Anchors/aliases are a common ergonomics pattern for config files with repeated rule definitions (the project I hit this on has ~60 aliases in its .herb.yml).

Reproduction

Before this PR, loading a config like:

files:
  include: &patterns
    - "**/*.custom.erb"
  exclude: *patterns

raises Psych::AliasesNotEnabled. After this PR, it loads cleanly and both include and exclude resolve to the aliased list. See the new test loads configuration using YAML anchors and aliases in test/configuration_test.rb.

Changes

• lib/herb/configuration.rb: add aliases: true to the YAML.safe_load_file call
• test/configuration_test.rb: new regression test

Test plan

• bundle exec rake test locally for ConfigurationTest (full suite needs native build; maintainer CI will exercise it end-to-end)
• Verified underlying Psych call with and without aliases: true against a minimal YAML fixture