fix(R-1187 b): restored links point only downward — no absolute target, no '..', no link on the way

Third automated security review finding, red-proved.

CHANGELOG.md

@@ -41,6 +41,9 @@ hub answers 400 to both and nothing else changes.
   passed the path-text check while really pointing above the folder — now refused and listed
   (`TestR1187b_NoLinkThroughALinkedParent`, red-proved). psql takes `--set=ON_ERROR_STOP=1` (the `-v` short form tripped
   the docker `-v` gate); the four new message keys are listed in `scripts/i18n_go_keys.json` as born keys.
+  A third review finding: a link TARGET through a link already in the folder („x" → „evil/y", evil pointing out). The rule
+  is now strict and simple: a restored link points only DOWNWARD — relative, no „..", no link on its path or in its
+  target; everything else is refused and listed (`safeDownwardLink`; `TestR1187b_NoLinkTargetThroughALink`, red-proved).
 - **R-1298:** the hold report skips an install's hold (`unhealthy_stop`, `update_failed`, `putback_pending`) of an app that
   is not installed (`holdreport.Reporter.SetInstalled`: the app's `app.yaml` exists — an unreadable one still counts,
   R-1220) and reports it cleared if it was reported; a restore hold is always reported (R-379). 9202's four orphan holds