Fix code scanning alert - Uncontrolled data used in path expression

[houko]

Tracking issue for:

• https://github.com/houko/SpringBootUnity/security/code-scanning/1

[houko]

该告警已在 PR #44（fix: resolve all six CodeQL security alerts, 提交 0597a65）中修复：FileUtil 上传文件落盘前先过滤路径字符，并用 normalize() + startsWith() 把路径限制在 upload 目录内，防止目录穿越。CodeQL 复扫后该告警已标记为 fixed，关闭。