fix(foundry-toolchain-zksync): prevent path traversal vulnerabilities via toolchain version strings

[mozluk]

Motivation

This PR resolves a High-severity path traversal vulnerability in the foundry-toolchain-zksync repository, identified during the workspace-wide security audit. Previously, the toolchain version string supplied to the GitHub Action was used directly to construct filesystem paths and download URLs. Because the version string was not validated or sanitized, an attacker-controlled string such as ../../etc/ could allow directory traversal, escaping the intended installation directory. If interpolated into the release download URL, it could also point the download to an arbitrary repository, causing the runner to execute an attacker-supplied binary.

Modifications

• Path Traversal Rejection (src/utils.js, dist/index.js):
  • Implemented strict validation in normalizeVersionName using a regular expression (/^[A-Za-z0-9][A-Za-z0-9._-]*$/) to restrict the version string to a safe, alphanumeric format.
  • Added an explicit check for version.includes("..") to reject any parent-directory traversal attempts outright, throwing an Invalid version input error if detected.
  • Updated dist/index.js (compiled output) by applying the 9-line semantic patch directly to maintain parity with src/utils.js without generating line-ending (CRLF) churn. (Note: dist/index.js.map was deliberately left at HEAD to avoid semantic-free diffs caused by Windows pathing).

Checklist

• Format your code according to the Contributor Guide.
• Add unit tests as outlined in the Contributor Guide.
• Update documentation as needed, including docstrings or example tutorials.