fix(app): path traversal via bulk downloads paths

[psychedelicious]

Summary

Fix an issue where the bulk image download route could allow directory traversal on Windows.

When getting a bulk download item and validate the path, we do two new checks:

• New check: The file that will be retrieved by the route is in the bulk downloads temp dir (i.e. its parent dir is exactly the bulk downloads temp dir)
• New check: The file name ends in .zip
• Existing check: The file exists

Related Issues / Discussions

n/a

QA Instructions

• Create a file in some directory outside the Invoke install and write something to it, e.g. C:\Temp\foo.txt with content "bar"
• Go to the API docs http://localhost:9090/docs#/images/get_bulk_download_item
• Provide a relative path as the item name, e.g. ..\..\..\foo.txt (the relative path will differ depending on your system)

On main, you'll get the file back. On this PR, you'll get a 404 not found.

Merge Plan

n/a

Checklist

• The PR has a short but descriptive title, suitable for a changelog
• Tests added / updated (if applicable)
• ❗Changes to a redux slice have a corresponding migration
• Documentation added / updated (if applicable)
• Updated What's New copy (if doing a release after this PR)