XAML: constrain document-link targets to allowed roots

Follow-up from the PR #50 review (finding M1).

server/src/WinUiXaml.LanguageServer/XamlDocumentLinks.cs Combine() (lines 134-152) resolves a link target with Path.GetFullPath and then probes File.Exists, with no containment check against the workspace/project root. A crafted Source="C:\..." or a ..-heavy relative path in a XAML file therefore produces a clickable document link to an arbitrary local path.

Severity is limited because:

• package.json declares untrustedWorkspaces: "limited", so the server does not run in untrusted workspaces.
• The result is a link the user must click, not an automatic read of file contents.

The reason this was not fixed in PR #50: server/test/WinUiXaml.LanguageServer.Tests/XamlDocumentLinksTests.cs lines 265-272 explicitly asserts that an out-of-root absolute path such as C:\other\Colors.xaml resolves to a link. Tightening Combine() would break a blessed test, so this needs a product decision first.

Suggested work:

• Decide whether absolute out-of-root link targets are intended (they are legitimate for some shared-resource-dictionary layouts).
• If not, constrain resolution to the project/workspace roots and update XamlDocumentLinksTests.cs accordingly.

Start with Combine() in server/src/WinUiXaml.LanguageServer/XamlDocumentLinks.cs and the out-of-root case in server/test/WinUiXaml.LanguageServer.Tests/XamlDocumentLinksTests.cs. Resolve the product decision about absolute targets first; done means the chosen containment policy is implemented and the affected test assertions match it.