[slack-22.0]: backupengine: disallow path traversals via backup MANIFEST on restore (#19470)

[rvrangel]

Description

backport of vitessio#19470

Related Issue(s)

Checklist

• "Backport to:" labels have been added if this change should be back-ported to release branches
• If this change is to be back-ported to previous releases, a justification is included in the PR description
• Tests were added or are not required
• Did the new or modified tests pass consistently locally and on CI?
• Documentation was added or is not required

Deployment Notes

AI Disclosure

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 69.78%. Comparing base (b1ab347) to head (bab20f1).
⚠️ Report is 32 commits behind head on slack-22.0.

Additional details and impacted files

@@              Coverage Diff               @@
##           slack-22.0     #805      +/-   ##
==============================================
+ Coverage       67.53%   69.78%   +2.24%     
==============================================
  Files            1600     1605       +5     
  Lines          261782   214027   -47755     
==============================================
- Hits           176786   149349   -27437     
+ Misses          84996    64678   -20318     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.