fix: sanitize client-provided filename in UploadedFile::move() to prevent path traversal

[gr8man]

Description
Currently, when developers call $file->move($targetDir) without explicitly providing the $name parameter, the system defaults to $this->getName(), which returns the original, unverified filename provided by the client in the $_FILES array. This creates a severe Path Traversal (Arbitrary File Write) vulnerability. If a malicious client uploads a file named ../../public/shell.php, the built-in move_uploaded_file() function will resolve the path and successfully write the script outside the intended upload directory, leading to potential Remote Code Execution (RCE).

This PR mitigates the vulnerability by applying the sanitize_filename() helper to the client-provided $name fallback in UploadedFile::move().
Crucially, the sanitization is applied only when the developer does not explicitly pass the $name argument. This ensures full backward compatibility for developers who manually and intentionally specify valid relative path structures (e.g., $file->move($dir, 'subdir/file.jpg')).

A new unit test (testMovePathTraversal) was added to FileMovingTest.php to ensure that path traversal attempts (like ../public/shell.php) are properly neutralized into safe filenames (like publicshell.php) and kept strictly within the intended destination directory.

Checklist:

• Securely signed commits
• Component(s) with PHPDoc blocks, only if necessary or adds value (without duplication)
• Unit testing, with >80% coverage
• User guide updated

[mergeable]

Hi there, gr8man! 👋

Thank you for sending this PR!

We expect the following in all Pull Requests (PRs).

• PRs must be sent to the appropriate branch
• All git commits must be GPG-signed
• Must follow our style guide
• Be commented in the PHP source file
• Be documented in the user guide
• Be unit tested
• Pass all checks in GitHub Actions

Important

We expect all code changes or bug-fixes to be accompanied by one or more tests added to our test suite to prove the code works.

If pull requests do not comply with the above, they will likely be closed. Since we are a team of volunteers, we don't have any more time to work
on the framework than you do. Please make it as painless for your contributions to be included as possible.

See https://github.com/codeigniter4/CodeIgniter4/blob/develop/contributing/pull_request.md

Sincerely, the mergeable bot 🤖