fix(ng-dev): prevent arbitrary file write via symlink

[josephperrott]

This PR addresses a vulnerability where arbitrary file writes/information leaks could occur via symlink dereferencing when copying user-controlled files into the optimization build output.

Changes:

• Removed the -L (dereference) flag from cp -Rf in optimize.sh to prevent copying symlink targets.
• Added a pre-build genrule in index.bzl that acts as a strict security gatekeeper. It validates the original workspace srcs and securely aborts the build if any of the underlying source files is a symlink, fulfilling strict architectural security requirements while maintaining compatibility with Bazel's internal sandbox symlinking.

[gemini-code-assist]

Code Review

This pull request introduces a security check to prevent symbolic links in user input by adding a genrule in index.bzl and removing the -L flag from the copy command in optimize.sh. A critical security issue was identified in the genrule where relative symlinks are resolved incorrectly relative to the execroot instead of the symlink's directory, potentially bypassing the check. A code suggestion has been provided to resolve this path resolution issue.