Fix path traversal vulnerability in init-from-code template file download

[Copilot]

Paths from the GitHub API tree response were passed directly to os.WriteFile and os.MkdirAll without sanitization, allowing a malicious repository to write files outside the working directory.

Changes

• Path validation on ingestion: Before adding entries to the files slice, each path from the GitHub tree API is now sanitized and validated:
  • filepath.Clean() normalizes the path
  • filepath.IsAbs() rejects absolute paths
  • strings.HasPrefix(cleanPath, "..") rejects directory traversal attempts
• Clean path stored in struct: templateFileInfo.Path now holds only the validated cleanPath, so all downstream uses—os.MkdirAll, os.WriteFile—operate on safe values

// Guard against path traversal or unexpected absolute paths
cleanPath := filepath.Clean(entry.Path)
if filepath.IsAbs(cleanPath) || strings.HasPrefix(cleanPath, "..") {
    return fmt.Errorf("invalid path in repository tree: %s", entry.Path)
}

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.