Function validate_path_within 

pub fn validate_path_within(path: &Path, root: &Path) -> Result<PathBuf, Error>

Validate that a resolved path does not escape a root directory.

Canonicalizes both paths and checks containment. Returns the canonicalized path on success.