fix(chart): write expanded chart files through os.Root - #32773

What this PR does / why we need it:

Expand and ExpandFile in pkg/chart/v2/util (and the copy in internal/chart/v3/util) write the files of a chart archive to disk. They are used by helm pull --untar and by helm lint on a packaged chart. Each output path is built with securejoin.SecureJoin and then written with the os package.

That path is only right at the moment it is computed. The filepath-securejoin README describes the SecureJoin API as "fundamentally unsafe" when path components can change between the join and the use, and recommends newer APIs for new code. SecureJoin also deals with a symlink in the destination that points outside it by rewriting it into a path inside the destination, so extraction carries on and writes somewhere the archive did not name.

Writes that leave their intended directory have come up in Helm several times: GHSA-hr2v-4r36-88hr (chart extraction collapsing into the output directory through a dot segment chart name), GHSA-v53g-5gjp-272r (a chart saved outside its directory through its name) and GHSA-557j-xg8c-q2mm (Chart.lock written through a symlink), and for plugins GHSA-vmx8-mqv2-9gmg and GHSA-qq3j-xp49-j73f. All of those are fixed. This PR does not fix a known vulnerability. It removes the path joining from chart expansion, so that a chart file cannot be written outside the chart directory by construction instead of relying on each path check being right.

The change:

• Expand opens the destination with os.Root, creates the chart directory through it, then opens a second os.Root on the chart directory and writes every file through that one.
• The chart name checks added for GHSA-hr2v-4r36-88hr are unchanged. The check that the chart directory is never the destination itself is kept; with no joined path left to compare, it now compares the two directories with os.SameFile.
• An empty destination still means the current directory.

os.Root was added in Go 1.24, and Root.MkdirAll and Root.WriteFile in Go 1.25; main and dev-v3 both declare go 1.26.0. #32774 does the same for plugin extraction. Once both are merged nothing imports github.com/cyphar/filepath-securejoin any more, and I will add the go mod tidy change to whichever of the two is merged second (or send it separately).

Special notes for your reviewer:

For well formed charts nothing changes: same files and layout, directories 0755, files 0644, and the same errors for bad chart names and for archive entries the loader rejects. The behaviour changes, all for unusual destinations or entry names, are:

1. A symlink already in the destination that leads outside the chart directory (the chart directory itself, a subdirectory or a file) now makes Expand fail with an error ending in path escapes from parent. Before, SecureJoin rewrote it into a path inside the destination and extraction continued there.
2. Absolute symlinks are refused even when they point inside the chart directory, because os.Root does not follow absolute links. Before, SecureJoin rewrote them to a path under the destination (the absolute path appended to it). Relative symlinks that stay inside the chart directory are still followed.
3. On Windows, entries with names that os.Root refuses, such as a:b.yaml (an alternate data stream) or a reserved device name like con, now fail with path escapes from parent. Before, the data went into the stream or to the device.

Tests: in both expand_test.go files, one table test feeds archives that try to leave the destination (an entry with .., an absolute entry, and a symlink entry followed by a write through it) and destinations that already contain symlinks pointing outside (chart directory, subdirectory, file, and a chart directory symlinked to the destination itself). Every case must fail, leave the outside directory empty and write nothing into the destination root. Other tests check that a well formed chart with nested directories, with and without directory entries, is written with the same content and modes into a destination that does not exist yet, that a relative symlink inside the chart directory is still followed, and that an empty destination still extracts into the current directory.

On main, the three cases with an existing symlink pointing outside fail in each package: Expand succeeds and writes at the rewritten path. Every other new test passes on main and on this branch. The symlink cases skip on Windows when symlinks cannot be created; I ran them on Linux.

If applicable:

• this PR contains user facing changes (the docs needed label should be applied if so)
• this PR contains unit tests
• this PR has been tested for backwards compatibility