pub fn validate_path(path: &Path, policy: &SandboxPolicy) -> Result<(), String>
Validate that a path does not escape allowed boundaries.