fix: prevent profiler file symlink escapes

[shhahbaz]

Changes

• Harden the profiler file endpoint against symlink-based path escapes.
• Canonicalize existing requested paths with realpath before reading.
• Reject resolved paths outside the NodeLink project root.
• Revalidate the final readable path after compiled dist to authored src fallback resolution.
• Preserve the existing 404 behavior for missing files.
• Add regression coverage for:
  • Valid in-project file access.
  • Direct symlink escapes.
  • Actual profiler endpoint responses.

Why

The profiler file endpoint already blocked lexical .. traversal, but a symlink located inside the project could point to a file outside the project root. Because filesystem reads follow symlinks, an authorized profiler request could disclose arbitrary local files.

This change closes that gap by validating the resolved path before reading it, while keeping the existing behavior unchanged.

Checkmarks

• The modified endpoints have been tested.
• Used the same indentation as the rest of the project.

Additional information

• Missing files continue to return the existing 404 response.
• Malformed file URLs and unexpected filesystem errors fail closed.

[github-actions]

All Contributors have signed the CLA. The PR is now allowed to be merged.
_{Posted by the CLA Assistant Lite bot.}

[shhahbaz]

I have read the CLA Document and I hereby sign the CLA