fix(security): allow safe in-repo symlinks

[Canvinus]

Summary

• follow only symlinks whose resolved target stays inside the checked-out repo root
• preserve the symlink path in the IPFS upload while reading from the resolved safe target
• keep external, broken, recursive, and non-regular symlink targets skipped

Addresses Codex feedback on #5 about preserving safe in-repo symlinks without reopening the external file leak.

Verification

• docker run --rm -v /Users/andrey/Documents/SourceScan/verifier-back:/src:ro -w /tmp/work node:24-alpine sh -lc 'cp -a /src/nest/. . && npm ci && npm run lint && npm test -- --runInBand && npm run build && diff -u /src/nest/src/services/ipfs/ipfs.service.ts src/services/ipfs/ipfs.service.ts && diff -u /src/nest/src/services/ipfs/ipfs.service.spec.ts src/services/ipfs/ipfs.service.spec.ts'
• lint passed
• 9 Jest suites passed, 44 tests passed
• nest build passed
• eslint --fix left touched files unchanged