[Security] Rebuild cross-platform filesystem path containment boundary

[seonghobae]

Buyer/security impact

validate_analysis_job_request currently rejects explicit .. path segments for localSource.sourcePath, cacheRoot, and tempRoot, but a prior security PR demonstrated that Windows drive-relative forms such as C:.. can bypass the simple separator/split check. The prior PR was closed after its branch was found to include unrelated dependency/lockfile drift and a weakened secret-scan ignore; none of that prior-head evidence is reusable.

Required implementation

Create a clean test-first security slice from protected develop that:

• explicitly defines whether each field accepts absolute, relative, drive-relative, UNC, and device paths;
• rejects parent traversal and Windows drive-relative traversal without over-rejecting legitimate paths;
• canonicalizes and enforces containment at the filesystem authority boundary before read/write use, rather than relying solely on lexical substring checks;
• treats symlink/reparse-point behavior as part of the authority check where relevant;
• adds POSIX and Windows adversarial cases including mixed separators, drive-relative forms, UNC/device paths, dot segments, repeated separators, and normalization edge cases;
• adds property/fuzz coverage where practical;
• keeps errors payload/path safe;
• makes no dependency, package-lock, .trivyignore, workflow, model, or unrelated product change;
• updates CHANGELOG.md and security/doctoring material with current authoritative primary references and APA 7 entries for any normative security claim.

Merge gate

Require exact-current-head unit/integration tests, owned production statement and branch coverage 100%, public API docstrings 100%, CI, SAST, security, supply-chain checks, independent automated review, zero unresolved actionable threads, and qualifying independent non-author approval. Do not bypass repository protections or treat prior/queued/skipped evidence as success.

Supersedes the abandoned implementation attempt in #825.