reject signed manifest paths that escape the model directory

[Support-itecz]

Summary

With ignore_unsigned_files enabled, verifying.Config.verify builds the list of files to hash by joining each resource identifier from the signed manifest onto the model path, with no check that the result stays inside the model directory. A manifest whose resource name is ../secret.txt (or ../../etc/hosts) makes the verifier open and hash a file outside the model root. Anyone whose signature your configuration accepts (for example a keyless identity you verify against) can therefore steer reads outside the intended directory during verification.

This resolves each joined path and rejects any that escape the model root before hashing, matching the containment approach already used for ignore-paths in _cli._resolve_ignore_paths. Keeping the check in the verifier means every signing method benefits without callers needing their own guard. Added a key-signed regression test that crafts a manifest with a .. path and confirms verification now raises, plus a positive case that in-model paths still verify. To reproduce before the fix: sign a manifest containing a ../ resource, then verify(..., ignore_unsigned_files=True) reads the outside file and can pass.

Checklist

• All commits are signed-off, using DCO
• All new code has docstrings and type annotations
• All new code is covered by tests. Aim for at least 90% coverage. CI is configured to highlight lines not covered by tests.
• Public facing changes are paired with documentation changes
• Release note has been added to CHANGELOG.md if needed

[stefanberger]

You should put your description above into the patch description.

[Support-itecz]

Done, moved the description into the commit message.

[mihaimaruseac]

Let's wait on this one until we have all conformance tests in https://github.com/ossf/model-signing-spec and validate the spec there.