pub fn validate_path( path: &Path, workspace_root: &Path, ) -> Result<PathBuf, SecurityError>
Validate that a path is within the workspace boundary