adk web GET/DELETE test endpoints skip the create_test path sanitiser

[Oskii]

Expected Behavior

create_test strips directories from test_name with os.path.basename so a name cannot leave the app tests/ folder.

GET, DELETE, and rebuild of a single test should use the same rule.

Actual Behavior

On main @ b018062, only create_test calls os.path.basename. delete_test, get_test_content, and rebuild_app_tests join test_name as given.

A percent-encoded path segment ../outside.json (%2e%2e%2foutside.json) on DELETE/GET is joined onto tests/ and can read or remove a JSON file in the agent directory, outside tests/.

rebuild?test_name=../outside.json does the same for the rebuild path.

This is the local adk web server. It is unauthenticated. Default bind is loopback. It still matters when --host 0.0.0.0 is used, or when anything else can hit those routes.

Steps to Reproduce

1. adk web (or the TestClient in tests/unittests/cli/test_adk_web_server_tests.py)
2. Put outside.json in the agent directory, not in tests/
3. DELETE /dev/apps/<app>/tests/%2e%2e%2foutside.json
4. On current main, that file is removed. After sanitising with basename, the request 404s and the file stays.

I can send a PR that shares one helper with create_test and adds those cases to test_adk_web_server_tests.py.