feat(context): add SaveUploadedFileToRoot with root-constrained uploa…

[tangerineyu]

#4488

Summary

This PR adds SaveUploadedFileToRoot, a safer upload API that constrains all filesystem operations within os.Root, preventing path traversal and symlink escape writes.

Why

SaveUploadedFile is convenient, but when destination paths may be influenced by user input, writes should be constrained to a fixed upload root.

What changed

• Added SaveUploadedFileToRoot(file, dst, root, perm...)
• Refactored shared upload logic into an internal helper used by both upload methods
• Added tests for normal save, path traversal rejection, and symlink escape rejection
• Updated docs with secure upload guidance using os.OpenRoot

Tests

• context_test.go full suite passes
• New upload-to-root security tests pass

Compatibility / Risk

• No breaking API changes
• New method relies on Go 1.25+ os.Root APIs

[codecov]

Codecov Report

❌ Patch coverage is 85.71429% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 98.32%. Comparing base (3dc1cd6) to head (1658e4e).
⚠️ Report is 275 commits behind head on master.

Files with missing lines	Patch %	Lines
context.go	85.71%	2 Missing and 2 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #4590      +/-   ##
==========================================
- Coverage   99.21%   98.32%   -0.90%     
==========================================
  Files          42       48       +6     
  Lines        3182     3160      -22     
==========================================
- Hits         3157     3107      -50     
- Misses         17       43      +26     
- Partials        8       10       +2     

Flag	Coverage Δ
	?
--ldflags="-checklinkname=0" -tags sonic	98.30% <85.71%> (?)
-tags go_json	98.24% <85.71%> (?)
-tags nomsgpack	98.29% <85.71%> (?)
go-1.18	?
go-1.19	?
go-1.20	?
go-1.21	?
go-1.25	98.32% <85.71%> (?)
go-1.26	98.32% <85.71%> (?)
macos-latest	98.32% <85.71%> (-0.90%)	⬇️
ubuntu-latest	98.32% <85.71%> (-0.90%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.