component manifest paths can escape the toolchain install prefix

manifest.in component paths appear to be trusted after decoding. ComponentPart::decode() converts the path string directly into a PathBuf, and transaction operations only guard with relpath.is_relative(). However, paths containing parent components like ../outside are still relative.

Those paths are later joined with the install prefix via InstallPrefix::abs_path(), so a component manifest entry such as:

file:../outside-file

can target a path outside the toolchain directory during install. Those paths are persisted into component manifests and can later be used during uninstall; rollback also uses the recorded transaction paths.

https://github.com/rust-lang/rustup/blob/4b1423bf74aa6102068b34ab52ccc28de5ff2aa9/src/dist/component/components.rs#L221

https://github.com/rust-lang/rustup/blob/4b1423bf74aa6102068b34ab52ccc28de5ff2aa9/src/dist/component/transaction.rs#L181-L183

Ideally, component manifest paths should be confined to the toolchain install prefix. Absolute paths, prefix paths, empty paths, and paths containing .. should be rejected as corrupt component manifests.

It may also be worth validating that the package source path stays under the extracted package root.

Ref:

• #4179 normalized component path separators, but does not appear to reject parent-directory components or enforce prefix containment.

Start with ComponentPart::decode() in src/dist/component/components.rs and the guards in src/dist/component/transaction.rs, then trace InstallPrefix::abs_path() and the recorded paths used by install, uninstall, and rollback. Add coverage for corrupt manifest paths and verify that absolute, empty, prefix, and parent-containing paths cannot escape the install prefix; also inspect package-source containment under the extracted root.