fix(security): reject path-traversal inputs in secret resolver

[tiagoek]

Summary

Fixes a path-traversal vulnerability in the secret resolver and AI Core config
module. Both built filesystem paths from unvalidated module/instance/
instance_name inputs. A crafted value (../default, /etc/passwd) could
select credentials outside the intended service binding — a potential
tenant-isolation bypass in multitenant agents.

Changes (SDK only — no consumer code changes required)

core/secret_resolver/resolver.py

• _validate_path_component(): rejects separators, absolute/UNC paths, ./..,
  NUL/control chars, >255-char values. Runs before any path assembly or
  env-var fallback — rejected values read no files.
• _assert_within_base(): canonical-path confinement (Path.resolve) as
  defense-in-depth against symlink/TOCTOU escape.
• Both wired into _validate_inputs() and both mount attempts
  (_load_from_mount + flat-path branch).

aicore/__init__.py

• _validate_path_component() + _assert_within_base() called at the start of
  _get_secret(), _get_aicore_base_url(), and _get_secret_dir_mtime()
  before the f-string path assembly.

Tests

• Full parametrized suite: absolute/UNC/relative traversal, separators,
  NUL/control chars, dot components, overlong values, symlink escape.
• Proof that a rejected value reads no files and attempts no env fallback.

Docs

• Security/validation section added to secret_resolver, aicore, and
  agent_memory user-guides.

No consumer changes required

This is a library-level control. Every agent or app using the SDK is protected
automatically on the next version upgrade. All observed production instance
values (default, aicore-instance, hr-advisor-destination-instance,
BTP tenant subdomains) are valid single-component identifiers and continue to
work unchanged.

The only behavioural change: a value that previously silently resolved to a
different binding now raises ValueError (fail-closed — correct behaviour).

Test plan

• pytest tests/core/unit/secret_resolver/ -v — 62 passed
• pytest tests/aicore/unit/test_aicore.py -v — 103 passed
• pytest tests/agent_memory/unit/ -v — 231 passed
• pytest tests/ -q --ignore=tests/aicore/integration — 3579 passed
• ruff check resolver.py aicore/__init__.py — all checks passed

[GAMAURER]

The logic looks good, missing tests in agent memory, + I am usually against expected security behavior being in the user guide. We could, and likely should look into having a consolidated security guide for the SDK. But scattering expected behavior onto multiple user guides seems to be both too verbose and not the right place for it.