Read --json from stdin or a file, so request bodies stay out of process arguments #952

Request bodies go in --json '<string>', so while the command runs, whatever is in them shows to every user on the machine through ps or /proc/<pid>/cmdline. For a calendar event that's the title, the description and the guest emails.

Could --json (and ideally --params) accept - to read from stdin, or @path to read a file, like curl's -d @file?

gws calendar events insert --params '{"calendarId": "primary"}' --json - < event.json

Context: I maintain an Omarchy calendar plugin that creates and edits events through gws, and a marketplace security review flagged this. I checked 0.13.2 and the changelog up to 0.22.5 and couldn't find a way around it, only the modelarmor helper reads stdin. If that approach works for you I can open a PR.