feat: enforce mandatory allowlist for security

[Madh93]

This PR addresses the security vulnerability where the bot, by default, is open to all Telegram users. This change implements a "secure-by-default" policy as suggested:

• Mandatory Allowlist: The telegram.allowlist is now a required configuration. The bot will refuse to start if it's left with the default placeholder value ([-1]).
• User Action Required: Users must now explicitly configure the allowlist with their specific Chat ID(s). To maintain the old behavior of allowing all users, they must consciously set the allowlist to an empty array ([]), though this is discouraged.
• Updated Documentation: The README.md has been significantly updated with a new Security Concerns section that explains this feature and provides clear instructions for users on how to find their Chat ID.

This makes the bot significantly more secure out-of-the-box and protects users from unsolicited messages and potential abuse.

Fixes #6