Jail LocalFetcher to a root directory and cap POM read size

[andrew]

LocalFetcher.walk follows <parent><relativePath> and reads files from disk. It already rejects absolute paths and symlinks but does not bound ../, so a hostile POM can read arbitrary files relative to the caller's working directory. This matters once the parser runs server-side against pushed repositories rather than a user's own checkout.

NewLocalFetcherFrom, NewLocalFetcher and ResolveLocal now take an fsRoot argument. The walk refuses to step outside it, and an empty fsRoot skips the walk entirely so callers handling untrusted bytes can opt out of filesystem access altogether. The containment check compares cleaned absolute paths with a trailing separator so /tmp/repo-evil is not treated as inside /tmp/repo.

Separately, ParsePOM now rejects input over MaxPOMBytes (10 MB, tunable), and readPOMFile, DirFetcher.Fetch and HTTPFetcher.FetchBytes apply the same limit at read time so an oversized file or response is never fully buffered.

This is a breaking change to the three LocalFetcher constructors. Known caller to update: manifests/internal/maven/maven.go:43.