Replace string-based startswith() path traversal check in validate_sandbox_path
with robust Path.is_relative_to(). The old check using str(target).startswith(str(root))
could be evaded by paths like /workdir/sandboxed/secret when root is /workdir/sandbox,
because the malicious path happens to start with the root string.
Path.is_relative_to() uses semantic path containment comparison and correctly
rejects /workdir/sandboxed/secret as escaping the sandbox at /workdir/sandbox.
Also added a docstring explaining the vulnerability pattern.
ISSUES CLOSED: #7478
controller-ci-rerun
HAL9000