Cloudreve's remote download file paths can escape the selected destination directory

### Summary Cloudreve trusts file paths returned by the configured remote downloader. A downloader-reported path such as `../../escaped.txt` can cause a downloaded file to be created outside the user-selected destination directory. ### Details In the remote download master transfer path, Cloudreve joins the user-selected destination URI with the downloader-reported file name. ```go // pkg/filemanager/workflows/remote_download.go:436-438 sanitizedName := sanitizeFileName(file.Name) dst := dstUri.JoinRaw(sanitizedName) src := filepath.FromSlash(path.Join(m.state.Status.SavePath, file.Name)) ``` The same issue also exists when constructing slave upload payloads. ```go // pkg/filemanager/workflows/remote_download.go:323-327 dst := dstUri.JoinRaw(sanitizeFileName(f.Name)) src := path.Join(m.state.Status.SavePath, f.Name) payload.Files = append(payload.Files, SlaveUploadEntity{ Src: src, Uri: dst, ``` The sanitizer does not remove `/`, `.`, or `..` path segments. ```go // pkg/filemanager/workflows/remote_download.go:648-650 func sanitizeFileName(name string) string { r := strings.NewReplacer("\\", "_", ":", "_", "*", "_", "?", "_", "\"", "_", "<", "_", ">", "_", "|", "_") return r.Replace(name) } ``` `JoinRaw()` splits the raw string by `/` and joins the segments, allowing `..` to affect the final URI path. ```go // pkg/filemanager/fs/uri.go:173-175 func (u *URI) JoinRaw(elem string) *URI { return u.Join(strings.Split(strings.TrimPrefix(elem, Separator), Separator)...) } ``` For ar