fix: symlink-based path traversal in file_manager (CWE-61/CWE-22) (#9902)

CWE-61 / CWE-22 in file_manager: check_access_permission used
os.path.abspath, which resolves '..' but not symbolic links, while
the subsequent kernel write follows symlinks. An authenticated user
could plant a symlink inside their storage area pointing outside it
and write to any path the pgAdmin process could reach.

Fix: switch to os.path.realpath for both orig_path and in_dir, and
add a new _open_upload_target helper that opens with O_NOFOLLOW
(and mode 0o600) to close the leaf-component TOCTOU between the
access check and the open. Drops the redundant post-write
check_access_permission call in add().

Mode change for uploaded files (0o644 -> 0o600) is intentional
hardening; release notes will call this out.

Tests: 16 file-manager security tests covering realpath enforcement
on all five access-check consumers and O_NOFOLLOW leaf-symlink
rejection.

The shared design proposal lives in docs/proposals/ and was added
in the preceding pickle-RCE commit.

Reported-by: Fernando Bortotti <fernando.bortotti@bsd.com.br>