Is your feature request related to a problem? Please describe.
The usual (and expected) behavior behind top-level allow script option is that it's merged with allow of subsequent script. This isn't problem at all.

But why --allow-* flags are being added to any command besides "deno run"? For example, whenever these are appended to "deno cache", it will complain about unexpected flags. Notice again that top-level allow is sebsequently inherited by all scripts. These flags are mostly specific to "deno run" only.

Describe the solution you'd like
Add condition to check whether full command starts with "deno run" and append --allow-* flags only when this condition is satisfied.

Describe alternatives you've considered
As workaround, I plant allow option individually on each script that involves "deno run".

Additional context

import { DenonConfig } from "https://deno.land/x/[email protected]/mod.ts";

const config: DenonConfig = {
  allow: {
    net: true,
  },
  lock: "lock.json",
  scripts: {
    start: {
      cmd: "src/bot.ts",
      desc: "Start the bot",
    },
    lock: {
      cmd: "deno cache --lock-write src/bot.ts",
      desc: "Lock dependencies for integrity checking",
    },
  },
};

export default config;

Denon resolves "lock" script to:

$ deno cache --allow-net --lock lock.json --lock-write src/bot.ts

To which "deno cache" returns error:

error: Found argument '--allow-net' which wasn't expected, or isn't valid in this context

It can happen basically with any command besides "deno run".