Path Traversal in writeFile via Unsafe Prefix Containment Check Allows Out-of-Directory Writes

Summary:

protodump uses descriptor-controlled paths (name/go_package) in output filename construction and then enforces containment with a lexical strings.HasPrefix check after EvalSymlinks. That check is bypassable with ../ traversal into existing prefix-matching sibling directories, enabling writes outside the intended output directory.

Steps To Reproduce:

1. First of all, build the protodump
2. Then, create a malicious input blob (descriptor name = ../out_pwn/evil.proto):

name = b'../out_pwn/evil.proto'
with open('/tmp/evil.bin', 'wb') as f:
    f.write(bytes([0x0a, len(name)]) + name + b'\x00')