fix(agents): prevent path traversal in AgentTool config_path resolution

[adilburaksen]

Summary

resolveSubAgentFromConfigPath in ConfigAgentUtils.java accepted absolute configPath values unconditionally and resolved relative paths without boundary validation. An attacker-controlled config_path field in an agent YAML could read arbitrary files.

Vulnerable pattern (before):

if (Path.of(configPath).isAbsolute()) {
    subAgentConfigPath = Path.of(configPath);   // absolute accepted
} else {
    subAgentConfigPath = configDir.resolve(configPath);  // no ".." check
}

Fix

• Reject absolute configPath values with ConfigurationException
• Normalize the resolved path and verify it stays within configDir before loading

Related

Same vulnerability exists in adk-python (PR: google/adk-python#5826) and adk-go — fix pattern is identical across all three SDKs.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[adilburaksen]

I have read the CLA Documents and I hereby sign the CLA.