storage: keep recursive downloads inside the destination folder

[pierre-emmanuelJ]

Description

exo storage download -r could still write outside of the destination folder: an object named public/../file is a valid in-bucket path, so it passed the check added in #823, but once the public/ prefix is stripped it landed one level above the destination.

• The check is now done on the local path the object is written to, not on the object key.
• Such objects are skipped with a warning (same behaviour as the AWS CLI); the rest of the download goes on.
• No impact on other downloads: single-object downloads and keys that stay inside the destination behave as before.

[sc-175532]

Checklist

(For exoscale contributors)

• Changelog updated (under Unreleased block, and add the Pull Request #number for each bit you add to the CHANGELOG.md)
• Testing

Testing

Unit tests, plus a new e2e scenario (storage_download_path_traversal.txtar) run against a real bucket.

---

Note

AI assistance: code, tests, PR description.

🤖 Generated with Claude Code

[pierre-emmanuelJ]

Note on os.Root, which was suggested as a safeguard: I left it out of this PR on purpose.

The check here is lexical (the final local path must stay under the destination), which is enough for the reported case. os.Root would be a stronger backstop, but it also refuses symlinks inside the destination that point outside of it, so a download into a folder with e.g. a subfolder symlinked to another disk would start failing. It also means reworking DownloadFile, which opens files by plain path today.

Happy to do it as a follow-up if we think the stricter behaviour is worth it.

[quentinalbertone]

you should delete IsTraversalPath this fonctoin doesn't work and it will confuse us in the future why two check: one on the key (which doesn't work every time) the other on on the write path

[pierre-emmanuelJ]

@quentinalbertone agreed, IsTraversalPath is removed along with its filter in storage download. The check on the local write path covers what it did (a unit case for ../file from the bucket root replaces its test). Unit tests and the storage_download_path_traversal e2e scenario pass. Also merged master to fix the changelog conflict.