Fix symlink validation for canonical project roots

[Akimbo92i]

Summary

Allow safeReadFile to read internal file symlinks when the project root path itself contains symlinks, while preserving rejection of targets outside the project root.

Changes

• Canonicalize both the candidate path and project root before comparing them.
• Use filepath.Rel path semantics for the containment check and propagate path-resolution errors.
• Add regression coverage for absolute and relative symlinked roots, external targets, and regular files.

Testing

Verified during the approved review:

• go test -run '^TestSafeReadFileSymlinks$' -count=1 -v ./detect
• go test -race -count=1 ./...
• go build ./...
• go vet ./...
• golangci-lint run
• git diff --check origin/main

Related Issue

Fixes #175

[abhinavgautam01]

Reviewed and tested locally. This correctly fixes #175 for both absolute and relative symlinked roots while preserving rejection of external targets. The regression tests fail before the fix and pass afterward.