feat: add comprehensive security and input validation system

[laurigates]

Summary

• Add PathValidator class for preventing path traversal attacks
• Add SecureSubprocessRunner for safe command execution
• Replace unsafe XML parsing with defusedxml for security
• Add comprehensive input validation tools for circuit generation
• Include security dependencies (defusedxml, bandit) in pyproject.toml
• Add security scanning job to CI/CD pipeline
• Add comprehensive test coverage for security utilities
• Add timeout constants for safe operation limits
• Add boundary validation for component positioning

Overview

This PR establishes a strong security foundation for the KiCad MCP server by implementing defense-in-depth security measures across all input vectors and external process interactions.

Changes Made

Security Infrastructure

• PathValidator: Comprehensive path validation system that prevents path traversal attacks, validates trusted root directories, and ensures file operations stay within safe boundaries
• SecureSubprocessRunner: Safe subprocess execution with input validation, timeout enforcement, and command whitelisting for KiCad CLI operations
• Secure XML Parsing: Replaced unsafe xml.etree.ElementTree with defusedxml to prevent XML external entity attacks and XML bombs

Input Validation

• Validation Tools: Circuit and component boundary validation for generated designs
• Boundary Validator: Component positioning validation to ensure proper circuit layout
• File Validation: KiCad file type validation with extension checking

Dependencies & CI/CD

• Security Dependencies: Added defusedxml>=0.7.0 and bandit>=1.7.0 to project dependencies
• Security Scanning: Added automated security scanning job using bandit in CI/CD pipeline
• Configuration: Added timeout constants and security-related configuration values

Testing

• Comprehensive Tests: Full test coverage for path validation, secure subprocess execution, and boundary validation
• Security Test Cases: Edge case testing for path traversal prevention and input validation

Dependencies

• Builds on PR FastMCP 2.0 Migration & Foundation #19
• Builds on PR Development Infrastructure & CI/CD #20
• Prepares foundation for PR feat: add circuit generation and text-to-schematic conversion #22

Testing

• All existing tests pass
• New security utilities have comprehensive test coverage
• CI/CD pipeline includes security scanning validation

🤖 Generated with Claude Code