fix(storage): Implement path containment to prevent traversal attacks

[shubhangi-google]

This pull request addresses a potential security vulnerability in the file download mechanism by implementing stringent path validation. The primary goal is to prevent malicious users from specifying paths that could lead to directory traversal attacks, ensuring that downloaded files are always written to safe, intended locations relative to the current working directory. This enhancement significantly improves the security posture of the file download feature.

Highlights

• Security Enhancement: Implemented robust path validation within the file download functionality to prevent directory traversal vulnerabilities.
• New Path Validation Method: Introduced a new private method, safe_path_for_download, which ensures that user-supplied download paths are relative and resolve strictly within the current working directory.
• Expanded Test Coverage: Added new acceptance tests to specifically verify that attempts to download files to absolute paths or paths containing directory traversal sequences correctly raise SecurityError.