fix: harden final upload writes and session bound export downloads

[ibrahimelnemr]

Description

• Resolves 5 high and 1 medium snyk vulnerabilities
• Restrict registered export downloads to insights belonging to the current session, open validated files before responding, and sanitize attachment filenames
• Normal upload naming and text/binary handling remain supported. Unsafe or colliding writes are rejected; missing/foreign-session downloads return 403

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.