## Summary

Introduced the `@kbn/fs` package that wraps node `fs` API with safe
defaults:

- every write resolves paths under the repo `data` root folder
- validates that there is no path traversal
- validates allowed file extensions
- validates allowed mime types
- validates allowed file sizes
- performs sanitization for svg

Introduced eslint rule `@kbn/eslint/require_kbn_fs` that flags the
direct write `fs` calls in production code. Severity is set to `warn`
for now and will be switched to `error` once migration is done in scope
of elastic#239385.

Exposed interface has a `volume` that serves as logical namespace. You
select a volume (e.g., `reports`, `exports/run-123`) and pass a file
name, `getSafePath` constructs a full path under `data/volume/...`. That
allows us to introduce per-volume restrictions later (file size, mime
types, etc) if needed and extend the interface without friction.

## How to test
You can add a test route to check that out easily.
<details>
  <summary>POST /internal/security/files</summary>

```ts
  export function defineFileRoutes({ router }: RouteDefinitionParams) {
    router.post(
      {
        path: '/internal/security/files',
        security: {
          authz: {
            enabled: false,
            reason: 'Test route for file operations',
          },
        },
        validate: {
          request: {
            body: schema.object({
              method: schema.string(),
              name: schema.string(),
              content: schema.string(),
              volume: schema.maybe(schema.string()),
            }),
          },
        },
      },
      createLicensedRouteHandler(async (context, request, response) => {
        const { method, name, content, volume = 'security-test' } = request.body;

        try {
          switch (method) {
            case 'writeFile':
              const resultWriteFile = await writeFile(name, content, {
                volume,
              });

              return response.ok({ body: resultWriteFile });
            case 'appendFile':
              const resultAppendFile = await appendFile(name, content, {
                volume,
              });

              return response.ok({ body: resultAppendFile });
            case 'writeFileSync':
              const resultWriteFileSync = writeFileSync(name, content, {
                volume,
              });
              return response.ok({ body: resultWriteFileSync });
            case 'appendFileSync':
              const resultAppendFileSync = appendFileSync(name, content, {
                volume,
              });
              return response.ok({ body: resultAppendFileSync });

            case 'createWriteStream':
              const writeStream = createWriteStream(name, volume);
              writeStream.write(content);
              writeStream.end();
              return response.ok({ body: 'ok' });

            case 'readFile':
              const fileContent = await readFile(name, volume);
              return response.ok({ body: fileContent });

            default:
              return response.customError(wrapIntoCustomErrorResponse(new Error('Invalid method')));
          }
        } catch (error) {
          return response.customError(wrapIntoCustomErrorResponse(error));
        }
      })
    );
  }
```
</details>

### Checklist
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [x] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
- [x] Review the [backport
guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)
and apply applicable `backport:*` labels.

__Closes: https://github.com/elastic/kibana/issues/239382__

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
(cherry picked from commit 20efb62)

# Conflicts:
#	.buildkite/scripts/steps/security/third_party_packages.txt
#	.eslintrc.js
#	.github/CODEOWNERS
#	package.json
#	src/dev/license_checker/config.ts
#	tsconfig.base.json
#	yarn.lock