chore: Add validation for operation slugs to prevent path traversal

[jkennedyvz]

Operation slugs are provided by the ASHIRT server or imported from export files and used to construct filesystem paths. Without validation, malicious slugs containing path traversal sequences (../, etc.) could cause evidence files to be written outside the intended evidence directory.

Changes:

1. Added StringHelpers::isValidOperationSlug() function

   • Validates slug format (alphanumeric, hyphen, underscore only)
   • Rejects empty or overly long slugs (>128 chars)
   • Explicitly blocks path traversal patterns (.., /, )

2. Applied validation in SystemHelpers::pathToEvidence()

   • Validates slugs from server at runtime
   • Logs warning and falls back to root evidence directory
   • Prevents compromised server from writing to arbitrary paths

3. Applied validation in SystemManifest::migrateDb()

   • Validates slugs from imported databases
   • Skips evidence with invalid slugs during import
   • Prevents malicious export files from exploiting path traversal

Attack scenarios prevented:

• Compromised ASHIRT server cannot write evidence to arbitrary locations
• Malicious export files cannot perform path traversal during import
• Social engineering attacks via crafted export files are mitigated

Impact:

• Defense in depth against server compromise
• Protection against malicious import files
• Maintains backward compatibility (valid slugs unchanged)

Security: Fixes MEDIUM severity path traversal vulnerability

• Please review our contributing guidelines
• Please review our Code of Conduct

I confirm that this contribution is made under the terms of the license found in the root directory of this repository's source tree and that I have the authority necessary to make this contribution on behalf of its copyright owner.