fix(skills): prevent path traversal in LocalSkillSource

[adilburaksen]

Summary

LocalSkillSource resolves caller-supplied skillName and resourcePath
strings directly onto the file system without validating that the resulting
path remains within skillsBasePath. A crafted value such as
../../../etc/passwd passes the Files.exists() check (the OS stat call
follows .. segments) and is returned as a valid resource path, enabling
arbitrary file reads from the host.

Affected methods: findResourcePath, listResources, findSkillMdPath.

Fix

Added a private validatePathWithinBase(Path base, String component) helper
that rejects:

• absolute path components (e.g. /etc/passwd)
• components whose normalized, absolute resolution escapes base
  (e.g. ../../secret)

The check mirrors the boundary enforcement already present in the Go
implementation (filesystem_source.go).

Tests

Five new test cases in LocalSkillSourceTest:

Test	Input	Expected
testLoadResource_pathTraversalInSkillName	skillName ../other-dir	SkillSourceException "Path traversal detected"
testLoadResource_pathTraversalInResourcePath	resourcePath ../../../etc/passwd	SkillSourceException "Path traversal detected"
testLoadResource_absoluteResourcePath	resourcePath /etc/passwd	SkillSourceException "Absolute paths are not allowed"
testListResources_pathTraversalInSkillName	skillName ../../etc	SkillSourceException "Path traversal detected"
testListResources_pathTraversalInResourceDirectory	resourceDirectory ../other-skill	SkillSourceException "Path traversal detected"

[hemasekhar-p]

Hi @adilburaksen, thank you for your contribution! We appreciate you taking the time to submit this pull request. I noticed some formatting inconsistencies in the test cases. could you please address these issues and run the full Maven build without skipping the test cases to ensure everything is compliant?

[hemasekhar-p]

@adilburaksen, Thank you for your quick response. As per contribution policy, please ensure your PR consists of a single commit. Could you please change your commits accordingly?

[adilburaksen]

Thanks for the review @hemasekhar-p. I've applied google-java-format to the test file so it matches the project style now, and I squashed everything down into a single commit as requested.

I also ran the full build with tests enabled (no skips) and it passes, including LocalSkillSourceTest (16 tests, all green). Let me know if anything else is needed.

[hemasekhar-p]

Thank you for your update @adilburaksen, Currently this PR is under review by our team, we will keep you posted if any additional information is required. thank you.

[hemasekhar-p]

@sherryfox, Could you please review this.

[adilburaksen]

Rebased onto current main — this is now a clean 2-file diff (the earlier large diff was a stale-branch artifact from an old base). validatePathWithinBase rejects absolute paths and any .. escape, applied in findResourcePath, listResources, and findSkillMdPath, with tests covering skillName and resourceDirectory traversal. PTAL @sherryfox @hemasekhar-p — happy to adjust.