fix path parsing to be cleaned and tested ahead of opening file

[bobcallaway]

This PR addresses a path validation vulnerability in pkg/config/parser.go by replacing a simple string prefix check with robust path canonicalization and relative path verification.

The previous implementation used strings.HasPrefix(path, basedir), which was vulnerable to two specific bypass techniques:

1. Sibling Directory Bypass:
   Paths like /a/bc/evil.yaml would incorrectly pass validation against a base directory of /a/b because the string prefix matches, even though they are sibling directories.

2. Lack of Canonicalization:
   Paths containing traversal sequences like /safe/dir/../../../etc/passwd would pass validation against /safe/dir because the raw string prefix matches, despite resolving to a location outside the base directory.