Harden CloudFormation artifact zipping

[dfgvaetyj3456356-hash]

Description

cloudformation package zips local artifact folders before uploading them. This tightens make_zip() so entries are only added when their resolved path remains inside the artifact root.

This prevents symlinked files or directories from causing the package step to include files outside the requested artifact directory, while preserving normal files under the root.

Tests

python -m py_compile awscli/customizations/cloudformation/artifact_exporter.py tests/unit/customizations/cloudformation/test_artifact_exporter.py
python -m pytest tests/unit/customizations/cloudformation/test_artifact_exporter.py::TestArtifactExporter::test_make_zip tests/unit/customizations/cloudformation/test_artifact_exporter.py::TestArtifactExporter::test_make_zip_skips_symlinked_directory_outside_root -q
git diff --check

Local result on Windows: 1 passed, 1 skipped because this session cannot create POSIX symlinks. A Windows junction proof against make_zip() showed only index.js was included and the linked outside file was not included.

This PR was generated with AI assistance and reviewed before submission.