Fix path traversal in CamaleonCmsAwsUploader and add regression coverage

[texpert]

This PR fixes a path traversal vulnerability in CamaleonCmsAwsUploader and adds focused uploader specs to prevent regressions.

Why

CamaleonCmsAwsUploader previously allowed unsafe keys (e.g. .. traversal or URI-like paths) to reach S3 operations in some mutating methods.
That creates a security risk and inconsistent behavior compared to guarded paths in other uploader flows.

Changes

• Added path validation guards (valid_folder_path?) to:
  • CamaleonCmsAwsUploader#add_file
  • CamaleonCmsAwsUploader#delete_folder
  • CamaleonCmsAwsUploader#delete_file
• These methods now return:
  • { error: 'Invalid file path' } for invalid file keys
  • { error: 'Invalid folder path' } for invalid folder keys
• No S3 operation is attempted when the path is invalid.

Tests

Added spec/uploaders/aws_uploader_spec.rb with:

• Negative/security cases

  • path traversal inputs (../...) for #add_file, #delete_folder, #delete_file
  • URI-like inputs (file://, s3://, https://) for #add_file, #delete_folder, #delete_file
  • assertions that invalid input returns the expected error payload and does not call destructive S3 methods

• Positive case

  • valid #add_file upload path
  • asserts uploader_aws_before_upload hook is invoked with expected payload
  • asserts S3 upload is called with expected key/options
  • asserts exact returned metadata payload shape