fix(binding): accept files nested under trusted directories on Windows

Environment

• main at 35bd5ecfcd84c8e457323a1bcf9453ba600c0270
• Windows/amd64
• Go 1.26.3

Reproduction

On a native Windows checkout:

go test ./internal/binding -run '^TestAssertSecurePath_TrustedDirs$' -count=1

The existing test fails when the target file is a child of the trusted directory:

unexpected error: test: path "C:\...\001\secret.txt" is not inside any trusted directory

Expected behavior

A file nested below a configured trusted directory should pass the containment check. A sibling path that only shares the directory-name prefix must still be rejected.

Root cause

requireInTrustedDirs cleans paths with filepath.Clean, which produces backslashes on Windows, but tests containment with a hard-coded / separator:

strings.HasPrefix(cleaned, cleanDir+"/")

Exact-path entries work, while descendant paths are rejected on Windows.

Impact

Windows users of file or exec secret providers cannot use the normal “trusted directory contains the provider” configuration; they must name the exact file or disable the check.

Suggested direction

Use platform-aware path containment (for example, filepath.Rel) and retain an explicit regression case for nested and sibling-prefix paths.

Duplicate check

I searched open and closed issues, all PR states, and repository history for trustedDirs, AssertSecurePath, and Windows path separators. #1475, #1514, #1515, and #1525 address Unix permission-bit checks on Windows, not trusted-directory containment.

Start by running go test ./internal/binding -run '^TestAssertSecurePath_TrustedDirs$' -count=1 and inspect requireInTrustedDirs plus TestAssertSecurePath_TrustedDirs. Replace the hard-coded separator containment check with platform-aware containment, then retain regression coverage showing nested trusted paths pass while sibling-prefix paths are rejected.