Security: Add path canonicalization to prevent directory traversal in scan()

[EffortlessSteven]

Vulnerability

The scan() function in tokmd-scan/src/lib.rs accepts user-provided paths without canonicalization, allowing potential directory traversal attacks.

Current Code

pub fn scan(paths: &[PathBuf], opts: &ScanOptions) -> Result<Languages> {
    // No canonicalization before walking
    // User could pass "../../../etc" as path
}

Fix Required

1. Canonicalize all input paths before walking
2. Validate that walked paths remain within intended boundaries
3. Add test cases for traversal attempts

References

• Rust std::fs::canonicalize()
• OWASP Path Traversal guidelines