Security fix: Add path validation to analyse_file tool (CWE-22)

[VadlaReddySai]

Summary

The analyse_file tool was passing user-supplied file_path directly
to open() with no validation, allowing path traversal attacks.

Vulnerability Details

File: server/gti/gti_mcp/tools/files.py, line 263
CWE-22 (Path Traversal) + CWE-200 (Sensitive Data Exposure)

An attacker with MCP client access could call:
analyse_file(file_path="/proc/self/environ")

This causes the server to read its own environment variables
including VT_APIKEY and upload them to VirusTotal.

Fix

Added os.path.realpath() validation to restrict file access
to /tmp/gti-uploads directory before opening any file.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[VadlaReddySai]

I have signed the CLA.

[VadlaReddySai]

@googlebot I signed the CLA!