Fix Validate readiness indicator file path

[odaysec]

Added validation to ensure readiness indicator file is a single filename without path separators or parent references.

the problem is that ReadinessIndicatorExistsNow and GetReadinessIndicatorFile accept an arbitrary string, normalize it, convert it to an absolute path, and pass it to os.Stat with no validation. To fix this, we should constrain what paths are acceptable. The most robust approach, given the limited context, is to restrict ReadinessIndicatorFile to a single filename (no directory separators, no ..), or at least to a relative path inside a specific safe directory. Since we do not see a configured safe directory in the snippets and must avoid changing broader behavior, the least intrusive and safest change is to require ReadinessIndicatorFile to be a single path component (filename) with no /, \, or ... That preserves existing functionality for the common case where a simple file name is used, and prevents traversal or absolute-path abuse.

Concretely, in pkg/types/conf.go we will modify both GetReadinessIndicatorFile and ReadinessIndicatorExistsNow so that they:

1. First validate readinessIndicatorFileRaw:
   • Reject if it is empty.
   • Reject if it contains /, \, or ".."
2. If invalid, return an error (or false + error) clearly indicating the problem.
3. If valid, proceed as before: filepath.Clean, filepath.Abs, and os.Stat.

This confines the path to a single component, eliminating directory traversal and uncontrolled file access, without changing any call sites or other behavior. No new imports or external dependencies are needed; we already import path/filepath and os in this file.