internal/releasesjson: Prevent path traversal

[radeksimko]

As reported by CodeQL scanner, the code in question is potentially vulnerable to path traversal, i.e. reading files outside of expected path. However, in the context of hc-install we generally trust the source ZIP files as hosted on releases.hashicorp.com, since HashiCorp produces all of them anyway.

That said, there's nothing wrong with defence in depth.

References

• Snyk: Zip Slip Vulnerability.
• OWASP: Path Traversal.
• Common Weakness Enumeration: CWE-22.

[bflad]

Looks good to me 🚀 The standard for HashiCorp release zip archives is never any path traversals. (If we really wanted to be pedantic, we could split unpack into its own function and unit test for this, but I'm not sure that's worth the effort to be honest.)