Harden .lst config import path validation

[metsw24-max]

Harden .lst build configuration import handling by restricting imported config files to the top-level configuration directory tree.

Changes

• Track the canonical top-level config directory for the initial .lst file
• Validate imported config files using canonical path resolution
• Reject imports that resolve outside the trusted root directory
• Fail closed if canonicalization fails
• Add regression coverage for traversal-based config imports

[kriegaex]

Just in case you are wondering why sometimes I comment or run workflows on your behalf, but am not committing or merging anything:

Please note my July 2024 message to the aspectj-users and aspectj-announce mailing lists regarding my situation as an AspectJ maintainer. Andy Clement has since returned to fixing issues and releasing updates, but he has very little time, so response times can be longer than you might expect. Nobody has yet offered to sponsor my work for this project, so I am still on hiatus until someone finally does.