fix(security): improve path traversal validation with comprehensive test

[fsdkibe]

Description

This PR enhances the security logic in EnforceToCurrentRoot by refactoring it to use filepath.Rel for validation. This serves as a security hardening improvement for the path traversal logic discussed in #25370.

Instead of manual string prefix checking, this implementation uses Go's standard library to robustly handle complex paths (including .. notation), ensuring strict directory containment.

Implementation changes

• Replaced manual string prefix checking with filepath.Rel for lexical containment.
• Added filepath.Clean to normalize paths before validation.
• Added explicit checks for .. to detect and block escape attempts.
• Simplified the function signature and logic for better maintainability.

Test improvements

• Added 10 core validation test cases covering various traversal attempts.
• Added edge case handling (empty paths, double slashes).
• Verified performance (~316ns/op).

Related

• Enhances logic in fix(path): normalize manifest-generate-paths to resolve '..' notation (#25366) #25370
• Relates to manifest-generate-paths does not work for absolute path that include ../ #25366

Checklist:

• Either (a) I've created an enhancement proposal and discussed it with the community, (b) this is a bug fix, or (c) this does not need to be in the release notes.
• The title of the PR states what changed and the related issues number (used for the release note).
• The title of the PR conforms to the Title of the PR
• I've included "Closes [ISSUE #]" or "Fixes [ISSUE #]" in the description to automatically close the associated issue.
• I've updated both the CLI and UI to expose my feature, or I plan to submit a second PR with them.
• Does this PR require documentation updates?
• I've updated documentation as required by this PR.
• I have signed off all my commits as required by DCO
• I have written unit and/or e2e tests for my change. PRs without these are unlikely to be merged.
• My build is green (troubleshooting builds).
• My new feature complies with the feature status guidelines.
• I have added a brief description of why this PR is necessary and/or what this PR solves.
• Optional. My organization is added to USERS.md.
• Optional. For bug fixes, I've indicated what older releases this fix should be cherry-picked into (this may or may not happen depending on risk/complexity).

[bunnyshell]

🔴 Preview Environment stopped on Bunnyshell

See: Environment Details | Pipeline Logs

Available commands (reply to this comment):

• 🔵 /bns:start to start the environment
• 🚀 /bns:deploy to redeploy the environment
• ❌ /bns:delete to remove the environment

[codecov]

Codecov Report

❌ Patch coverage is 86.66667% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 62.48%. Comparing base (7cdc0f9) to head (ad247a1).

Files with missing lines	Patch %	Lines
util/app/path/path.go	85.71%	1 Missing and 1 partial ⚠️
util/security/path_traversal.go	87.50%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #25515      +/-   ##
==========================================
+ Coverage   62.45%   62.48%   +0.03%     
==========================================
  Files         351      351              
  Lines       49490    49495       +5     
==========================================
+ Hits        30910    30928      +18     
+ Misses      15621    15606      -15     
- Partials     2959     2961       +2     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[ppapapetrou76]

LGTM - nice
Clean and concise

[blakepettersson]

Can we please use os.Root for this?

[blakepettersson]

See my comment

[fsdkibe]

@blakepettersson, as requested, I have made the necessary changes. I've also incorporated the necessary path normalization changes from PR #25370 into this branch to ensure all tests pass.

The path normalization changes were needed because the security refactor's tests require properly cleaned paths to validate correctly.

If the changes are now in line with what you suggested, then we can close the other PR.