Potential fix for https://github.com/mimz-devops/code-scanning-javascript-demo/security/code-scanning/1

To fix the issue, we need to validate header.linkname to ensure it does not contain directory traversal elements (..) or other malicious constructs before using it to construct srcpath. The best approach is to use a validation function that checks whether the resolved path remains within the intended root directory (cwd). This ensures that even if header.linkname contains malicious elements, they cannot escape the intended directory.

The fix involves:

1. Adding a validation step for header.linkname before constructing srcpath.
2. Using path.resolve to normalize the path and ensure it is within the cwd directory.
3. Rejecting or skipping entries with invalid paths.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.