fix(coverage): reject file: URIs outside known roots in Resolver - #2534

Resolver.resolve handled the file: scheme by resolving the URI straight
to a path and returning it, with no check that the path was anywhere
near the project being covered. The source field in coverage data is
supplied by whatever produced the coverage JSON; format_coverage
--pretty-print and filterIgnored both read the resolved path's content
into their output, so a coverage.json containing
"source": "file:///etc/passwd" gets that file's content read and
printed straight into the generated coverage report.

Verified by running the real format_coverage CLI against a crafted
coverage.json pointing at a file outside the project: the file's
content appeared in the pretty-printed report. The package: and dart:
branches aren't affected, since they resolve relative to a known
package or SDK root; a package: URI can't traverse out either, since
Uri.parse already collapses .. segments in the path before Resolver
ever sees them.

The fix adds a containment check for the file: branch, allowing a
resolved path only if it falls under packagePath, sdkRoot, one of the
known package roots, or the current working directory. Falls back to
null (already an existing, handled outcome for unresolvable URIs)
otherwise. Added a test that constructs a file outside every one of
those roots and confirms it no longer resolves, and a companion test
confirming a file: URI inside packagePath still resolves normally.
Confirmed the new rejection test fails without the fix and passes with
it.

dart analyze and dart format --set-exit-if-changed are clean on both
touched files, and the full pkgs/coverage test suite (139 tests) passes.

Use if (x != null) x instead of the null-aware ?x collection element
syntax, matching the reviewer's suggested style. Build the outside-root
test file under d.sandbox instead of a manually created and torn down
system temp directory, since d.sandbox is already managed and cleaned
up by the test framework.

Adds a changelog entry for the file: containment fix.

Adds tests covering the other roots _isWithinKnownRoots checks: sdkRoot,
a known package root from package_config.json, and the current directory.
Only packagePath had a positive test before.

Reverts the null-aware ?packagePath/?sdkRoot elements back from the
if (x != null) x form requested in an earlier review comment. CI runs
dart analyze --fatal-infos, and this package's own lints recommend the
null-aware form (use_null_aware_elements), so the if form was failing
analyze in CI even though it type-checks fine locally without the flag.