Harden branding image symlink check to cover ancestor directories (#3261)

Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

Author: Mpdreamz

src/Elastic.Documentation.Configuration/Builder/ConfigurationFile.cs

@@ -11,6 +11,7 @@
 using Elastic.Documentation.Diagnostics;
 using Elastic.Documentation.Extensions;
 using Elastic.Documentation.Links;
+using static Elastic.Documentation.Configuration.SymlinkValidator;
 
 namespace Elastic.Documentation.Configuration.Builder;
 
@@ -330,10 +331,11 @@ private static BrandingConfiguration ValidateBranding(BrandingConfiguration bran
 			return null;
 		}
 
-		if (resolved.LinkTarget is not null)
+		var symlinkError = ValidateFileAccess(resolved, context.DocumentationSourceDirectory);
+		if (symlinkError is not null)
 		{
 			context.EmitError(context.ConfigurationPath,
-				$"'{fieldName}' path '{imagePath}' is a symbolic link, which is not allowed for branding images.");
+				$"'{fieldName}' path '{imagePath}' is unsafe: {symlinkError}");
 			return null;
 		}