[risk] Path traversal in ShenyuPluginPathBuilder

### Question

/**
* Gets plugin file.
*
* @param path the path
* @return the plugin jar file.
*/
public static File getPluginFile(final String path) {
String pluginPath = getPluginPath(path);
return new File(pluginPath);
}

Start by locating ShenyuPluginPathBuilder and reading getPluginFile(String) together with the getPluginPath(path) implementation. Reproduce the reported path-traversal case, then identify the existing security tests or test location for this builder; done means plugin paths cannot escape the intended directory and regression coverage verifies the behavior.

Written by the indexing model from the issue text.