@embed on orphan files

[tvandinther]

Is your feature request related to a problem? Please describe.
I would like to define a simple one-off CUE file and make use of @embed() to load in files relative to the orphan file.

Describe the solution you'd like
Without initialising a module, I'd like to use @embed(file=foo.yaml,type=yaml) to embed a sibling file named foo.yaml.

Describe alternatives you've considered
Initialising a module would allow this but then you would have to manage a module. There are uses for orphan files over modules which keep things simple, especially for users unfamiliar with CUE but instructed to use it in documentation to perform some task.

Additional context
https://cuelang.slack.com/archives/CLT3ULF6C/p1772813469350559

[mvdan]

Thinking outloud in terms of options for supporting @embed for orphan files, i.e. files outside of any CUE module:

• Allow embedding any file underneath the same directory
• Allow embedding any file directly in the same directory
• Only allow embedding files if a special flag is used, such as --allow-embed-unsafe

Ultimately, whether inside a CUE module or not, we do want to disallow e.g. cue export from being able to read /etc/very-secret-file or ~/.config/ssh/id_ed25519 via file embedding.

[mvdan]

Also note @jpluscplusm's testscript reproducer from #3732.