Fix path traversal in FSLocation storage operations

[Code-ve]

Summary

This PR introduces path containment validation for filesystem-backed storage operations in FSLocation.

Previously, paths were resolved using posixpath.join() without verifying that the resulting path remained within the configured storage root. This allowed path traversal sequences (../) and absolute paths to resolve outside the intended workspace boundary.

Changes

• Added a centralized _safe_path() helper to normalize and validate paths before they are used in filesystem operations.
• Ensured that resolved paths remain within the configured storage root.
• Updated open, makedirs, listdir, isdir, exists, rmtree, invalidate_cache, and size to use the validated path resolution logic.
• Rejected paths that resolve outside the storage root.

Tests

Added regression tests covering:

• Valid paths within the storage root.
• Path traversal attempts using relative path segments (../).
• Absolute path access attempts.
• Validation through storage operations.

The implementation follows the containment-based remediation approach discussed in the issue and preserves the existing storage interface while preventing access outside the configured filesystem boundary.