Restrict COPY TO export paths

[shuwenwei]

Summary

• Restrict COPY TO targets with parent components to configured export directories.
• Reject targets under active-load listening and pipe directories to prevent SUPER_USER active-load ingestion bypasses.
• Perform canonical-path validation during relational analysis and keep the original target path for execution.
• Add an integration test for rejecting client-supplied absolute paths.

Verification

• git diff --check passed.
• Compile and tests were not run.

[codecov]

Codecov Report

❌ Patch coverage is 48.33333% with 31 lines in your changes missing coverage. Please review.
✅ Project coverage is 42.14%. Comparing base (d130239) to head (5fd188f).
⚠️ Report is 3 commits behind head on master.

Files with missing lines	Patch %	Lines
...java/org/apache/iotdb/commons/utils/FileUtils.java	0.00%	11 Missing ⚠️
...java/org/apache/iotdb/db/conf/IoTDBDescriptor.java	66.66%	9 Missing ⚠️
...ne/plan/relational/analyzer/StatementAnalyzer.java	0.00%	7 Missing ⚠️
...ain/java/org/apache/iotdb/db/conf/IoTDBConfig.java	73.33%	4 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##             master   #18573      +/-   ##
============================================
- Coverage     42.33%   42.14%   -0.20%     
  Complexity      414      414              
============================================
  Files          5415     5424       +9     
  Lines        390725   391414     +689     
  Branches      51182    51261      +79     
============================================
- Hits         165416   164953     -463     
- Misses       225309   226461    +1152     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.