Chrome extension file_upload path validation hardened and reused

The file_upload tool's path-safety checks, covering network path rejection, Windows-path spoofing detection, percent-encoding/.. rejection, and kernel alias-namespace rejection (paths like /dev, /proc, ..namedfork), are now factored into shared helper functions. These are applied both to a new lightweight pass-through validation path and the existing full resolve-and-check path, tightening protection against path traversal and spoofing when Claude-in-Chrome uploads local files.