fix(security): address CodeQL path-injection and log-injection alerts

[furykerry]

Summary

Address 43 CodeQL security alerts that do not require Kubernetes version upgrades:

• 31 go/path-injection alerts (CWE-22, CWE-23, CWE-36, CWE-73, CWE-99)
• 12 go/log-injection alerts (CWE-117)

This is Tier 3 of the code-scanning hardening effort, following:

• Tier 1: GitHub Actions security (feat(sandbox-manager): add network interface binding and reliable peer discovery #920)
• Tier 2: Workflow hardening (chore(workflows): harden GitHub Actions against zizmor and Scorecard findings #921)

Changes

Path injection prevention

Add validateSafePath barriers that reject empty paths and .. segments after filepath.Clean. Applied before all filesystem operations:

• pkg/agent-runtime/storage-cli/link/symlink.go — validate both target and link paths in CreateSymlink
• pkg/utils/webhookutils/writer/atomic/atomic_writer.go — validate targetDir in constructor and oldTsDir from symlink read
• pkg/utils/webhookutils/writer/fs.go — validate cert writer path in FSCertWriterOptions.validate()
• pkg/agent-runtime/storage-cli/mountfinder/root_mount_helper.go — validate resolved mount path before existence check

Log injection prevention

Add sanitizeLogValue helper that strips \n and \r characters. Applied to all log statements using user-controlled or filesystem-derived values:

• cmd/sandbox-gateway-cert-init/main.go — sanitize error in fatal log
• pkg/agent-runtime/storage-cli/main.go — sanitize origin directory, mount target path, and error messages
• pkg/agent-runtime/storage-cli/mountfinder/root_mount_helper.go — sanitize mount path in debug log
• pkg/utils/webhookutils/writer/atomic/atomic_writer.go — sanitize target directory and data directory paths in 5 log statements
• pkg/utils/webhookutils/writer/fs.go — sanitize file paths and error messages in cert directory operations

Testing

• All existing tests pass
• Updated symlink_test.go to match new error message format from validateSafePath
• Verified with go test on all affected packages

CodeQL alert resolution

This PR resolves all 43 non-Kubernetes-version-dependent CodeQL alerts identified in the Tier 3 hardening plan. The remaining 3 alerts require cel-go version bumps tied to Kubernetes 1.34+ and are out of scope for this PR.

Test plan

• go test ./pkg/agent-runtime/storage-cli/...
• go test ./pkg/utils/webhookutils/writer/...
• go test ./cmd/sandbox-gateway-cert-init/...
• Verify CodeQL scan no longer reports these 43 alerts after merge

[kruise-bot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please ask for approval from furykerry by writing /assign @furykerry in a comment. For more information see:The Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[codecov]

Codecov Report

❌ Patch coverage is 47.36842% with 20 lines in your changes missing coverage. Please review.
✅ Project coverage is 83.05%. Comparing base (b59aee6) to head (6bd4a3d).
⚠️ Report is 3 commits behind head on master.

Files with missing lines	Patch %	Lines
.../utils/webhookutils/writer/atomic/atomic_writer.go	0.00%	10 Missing ⚠️
pkg/utils/webhookutils/writer/fs.go	33.33%	4 Missing ⚠️
...ntime/storage-cli/mountfinder/root_mount_helper.go	0.00%	2 Missing and 1 partial ⚠️
pkg/agent-runtime/storage-cli/link/symlink.go	50.00%	1 Missing and 1 partial ⚠️
pkg/agent-runtime/storage-cli/main.go	66.66%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #928      +/-   ##
==========================================
- Coverage   83.09%   83.05%   -0.05%     
==========================================
  Files         257      259       +2     
  Lines       22536    22561      +25     
==========================================
+ Hits        18726    18737      +11     
- Misses       3095     3106      +11     
- Partials      715      718       +3     

Flag	Coverage Δ
unittests	83.05% <47.36%> (-0.05%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.