Potential fix for https://github.com/FRNKUSD/code-scanning-javascript-demo/security/code-scanning/1

To fix the issue, we need to validate header.linkname to ensure it does not contain directory traversal elements (..) or other unsafe characters before using it in a filesystem operation. The best approach is to check if the resolved path remains within the intended directory (cwd) after combining it with header.linkname. This ensures that malicious paths attempting to escape the target directory are blocked.

Steps to implement the fix:

1. Add a validation step for header.linkname before constructing srcpath.
2. Use a helper function to ensure the resolved path is within the cwd directory.
3. If the validation fails, log the issue and skip processing the entry.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.