fix(#45): harden download endpoints against path traversal

[linisha15]

Description:

Summary
This PR fixes #45 by preventing path traversal in all file download routes.

Changes

• Added strict validation for request path segments (rejects empty values, separators, and traversal values)
• Added resolved-path containment checks using Path.resolve() and Path.is_relative_to()
• Return 400 Bad Request for invalid/traversal file paths
• Preserve 404 Not Found behavior for missing files

Endpoints updated

• /downloadDataFile
• /downloadFile
• /downloadCSVFile
• /downloadResultsFile

File changed

• DataFileRoute.py

Security impact

• Blocks traversal payloads such as ../../../...
• Ensures resolved file path stays inside the intended base directory before serving files

Validation

• No diagnostics errors in the updated file
• Invalid/traversal paths now return 400
• Missing files continue to return 404

Closes #45

[Sameer-00001]

Hey @linisha15 Looks great! This correctly implements the pathlib containment check we discussed in Issue #45. Verified locally and it works.