[MINOR] Reject traversal segments in note and folder paths

[jongyoul]

What is this PR for?

NotebookRepo.buildNoteFileName composes a filesystem path or object-store key from a user-supplied note path. The previous implementation required only a leading / but otherwise concatenated the value verbatim, so a value such as /../etc/foo would compose to a location outside the configured notebook root for backends that perform a raw filesystem operation (FileSystemNotebookRepo) or build an object key directly from the string (S3 / Azure / GCS).

This PR centralises a small validation helper at the NotebookRepo interface level so every backend gets the same defence, fixes one folder-level path that bypassed buildNoteFileName, and adds the missing normalizeNotePath call in NotebookService.renameNote.

What type of PR is it?

Improvement

Todos

• Add NotebookRepo.rejectTraversalSegments (URL-decoded, recursive, capped at 5 layers).
• Call rejectTraversalSegments from the default buildNoteFileName, so every implementation is covered.
• Apply it to FileSystemNotebookRepo's folder-level move / remove, which build the path without going through buildNoteFileName.
• Add the missing normalizeNotePath in NotebookService.renameNote to match createNote, cloneNote, and moveFolder.
• NotebookRepoPathValidationTest (27): .., ., URL-encoded variants (%2e%2e, %2E%2E), double-encoded variants, and an excessive-encoding-layer payload. Realistic note names including Korean characters and ... inside a segment are accepted.

What is the Jira issue?

N/A — [MINOR] change.

How should this be tested?

./mvnw install -pl zeppelin-server -am -DskipTests
./mvnw test -pl zeppelin-server -Dtest='NotebookRepoPathValidationTest,NotebookServiceTest' -DfailIfNoTests=false
./mvnw test -pl zeppelin-plugins/notebookrepo/filesystem

All test sets pass locally.

Questions

• Does the license files need to update? No
• Is there breaking changes for older versions? No — existing valid note paths render to byte-identical filenames; only paths containing literal traversal segments now produce a clear IOException instead of silently composing to an out-of-root location.
• Does this needs documentation? No