fix: address Mend SAST findings from #215 (4 of 5 High)

[peatey]

Closes 4 of the 5 High severity findings in #215. Three commits, revertible
separately.

Mend finding	Severity	Status
CWE-22 Path Traversal uploader.go:469	High	fixed (SafePath)
CWE-73 File Manipulation uploader.go:371	High	fixed (SafePath)
CWE-73 File Manipulation uploader.go:507	High	fixed (SafePath)
CWE-918 SSRF metrics_collector.go:241	High	fixed (URL validation)
CWE-732 Insecure Dir Perms bingen-to-json/main.go:42	High	fixed
CWE-295 Insecure TLS ×2 nodes/config.go:45,48	Medium	not addressed — needs a decision
CWE-244 Heap Inspection ×2 clients.go:753, emitter.go:110	Medium	not addressed — needs a decision
CWE-916 Weak Hash util.go:95	Low	false positive — suppress

1. SafePath was not safe — closes three Highs at once

Mend taints all three uploader.go Highs back to one source: the
SafePath(samplePath) call at uploader.go:322. It doesn't trust SafePath as
a sanitiser, and it's right not to.

The function deleted every literal .. substring and then called
filepath.Clean. Doing the removal first is the bug — any sequence that
re-forms a traversal after deletion survives, because Clean then resolves it:

SafePath("/scratch", "....//....//etc/passwd")  ->  "/scratch/etc/passwd"
SafePath("/scratch", "..././..././etc/shadow")  ->  "/scratch/etc/shadow"

The same substring deletion also silently corrupted legitimate names — a cluster
id of v1..2-cluster became v12-cluster, writing samples to the wrong
directory.

Replaced with segment-aware filtering: split on the separator, discard only
segments that are exactly .. or .. A segment that merely contains dots is
an ordinary filename, so .... and v1..2-cluster survive intact and neither
can resolve to a parent reference. An explicit containment check against the
base element is added as defence in depth rather than relying on that reasoning.

The documented contract is unchanged — parent segments are dropped rather
than resolved (test/scratch/../file → test/scratch/file, not test/file),
and trailing separators are preserved. All eight pre-existing test cases pass
untouched; six were added for the two bypasses, base escape, and the
legitimate-name regression.

2. CWE-918 — presigned upload destination was unvalidated

uploadPayloadToPresignedURL PUTs the cluster's entire resource inventory to a
URL read from the location field of an API response. Nothing checked it, so a
tampered response could redirect that payload anywhere.

validateUploadURL now requires https (no plaintext downgrade) and a host
under amazonaws.com, cloudability.com or apptio.com, matched on a dot
boundary so evil-amazonaws.com doesn't satisfy amazonaws.com.

This function is shared by both upload paths, so the Apptio Frontdoor flow is
covered too, even though Mend only flagged the metrics-collector one.

⚠️ This is the one change that could break production if I've got it wrong.
The allowlist was derived from reading the code, not from the API contract.
Whoever owns that contract should confirm no region or deployment returns a
presigned URL on a domain outside those three. It's a single package-level
var if it needs extending.

Test fixtures previously returned locations on example.com, and the uploader
mocks used a bare relative path with no scheme or host at all — never realistic,
since a relative location would fail at request time in production regardless.
They now use a representative S3 presigned host, and the countByPath
assertions move with them since an absolute URL yields a leading slash on Path.

3. CWE-732 — bingen-to-json output permissions

0755 directories, 0644 files → 0750 / 0600. I'd originally excluded this
as "a dev tool, not runtime". Mend rates it High and it's a one-line change, so
that distinction wasn't worth defending.

Verification

go build ./...                              BUILD_OK
go vet ./...                                VET_OK
golangci-lint v2.2.1 (repo config)          0 issues
go test -count=1 ./...                      9/9 ok
cldy suite                                  43 specs, 0 failed, 0 skipped

The five new SSRF specs were mutation-checked: with the validateUploadURL
call removed they fail, and with it restored they pass — so they exercise the
control rather than passing incidentally.

Deliberately not in this PR

• CWE-295 ×2, InsecureSkipVerify: true. This is the kubelet TLS issue: the service-account bearer token is sent to node IPs over unverified TLS. The secure branch trusts the API server CA, which doesn't sign kubelet serving certs on most distros, so operators get pushed toward INSECURE=true. That needs a design decision (refuse to attach the token on an insecure transport, and fall back to the kube-proxy path?), not a lint fix. Happy to write up options.
• CWE-244 ×2, secrets held as Go string and therefore un-zeroable. Worth noting these are not purely theoretical here: /debug/pprof/heap is exposed on the same unauthenticated port when PPROF_ENABLED is set, which is a real path to reading the API key out of a heap dump. Fixing properly means moving these to []byte with the zeroing pattern already used elsewhere in the file.
• CWE-916, MD5 at util.go:95. Genuine false positive — it's the S3 Content-MD5 header the API requires, not a security primitive. Should be suppressed as false-positive rather than fixed.

Relationship to other open PRs

Independent of #223 (deps), #224 (govulncheck CI) and #225 (timeouts + runtime
dir perms). Branched from develop; no overlap in files with #225 despite both
touching cldy/, since SafePath's signature is unchanged.

Refs #215

🤖 Generated with Claude Code