fix: block traversal segments in standard page export paths

[surajshetty3416]

The semgrep frappe-security-file-traversal rule fires on the standard page exporters (export_page_as_standard, export_client_scripts), which write fixtures into an installed app's builder_files/ directory.

Both are gated behind frappe.conf.developer_mode and the path segments come from export_dir_name(), which scrubs the record name and replaces slashes. It did not, however, reject . or .. as a whole segment, so a record named .. would write one directory above its export root.

template_sync.py already had safe_segment() for exactly this. Moved it into builder/utils.py (which template_sync already imports from), routed export_dir_name() through it, and marked the audited writes # nosemgrep, matching how the template exporter annotates its own.

Tested with test_standard_page_sync (28) and test_utils (21), all passing.

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

_{Reviews (2): Last reviewed commit: "test: cover the export path segment guar..." | Re-trigger Greptile}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 66.06%. Comparing base (81174f2) to head (7d8211d).

Additional details and impacted files

@@             Coverage Diff             @@
##           develop     #787      +/-   ##
===========================================
+ Coverage    65.98%   66.06%   +0.08%     
===========================================
  Files           93       93              
  Lines        10373    10386      +13     
===========================================
+ Hits          6845     6862      +17     
+ Misses        3528     3524       -4     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[surajshetty3416]

Added regression coverage for the guard in test_utils (7d8211d): normal names, separator neutralisation (../../etc/passwd -> .._.._etc_passwd), and ValidationError on the empty/./.. segments.

[github-actions]

🎉 This PR is included in version 1.33.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀