fix(glob): prevent path traversal via '..' in glob patterns

[hsyodyssey]

Related Issue

N/A - Security fix for path traversal vulnerability in Glob tool

Description

This PR fixes a path traversal vulnerability in the Glob tool by rejecting patterns containing ...

Problem

The Glob tool did not validate patterns for .. sequences, allowing access to files outside the working directory (e.g., ../.env, ../.. /**/*.key).

Solution

Added validation in _validate_pattern() to detect and reject patterns containing path traversal sequences.

Changes:

• src/kimi_cli/tools/file/glob.py: Added .. check in _validate_pattern() method
• Normalizes path separators for cross-platform compatibility

Testing

• Patterns with .. are rejected with error message
• Valid patterns (*.py, src/**/*.js) still work correctly
• Cross-platform path separator handling

Checklist

• I have read the CONTRIBUTING document.
• I have linked the related issue, if any.
• I have added tests that prove my fix is effective or that my feature works.
• I have run make gen-changelog to update the changelog.
• I have run make gen-docs to update the user documentation.

---

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 4 additional findings.