fix(app-lib, labrinth): stricter mrpack file path validation (#4482)

* fix(app-lib, labrinth): stricter mrpack file path validation

* chore: run `cargo fmt`

* tweak: reject reserved Windows device names in mrpacks too

Cargo.toml

@@ -8,6 +8,7 @@ members = [
 	"packages/app-lib",
 	"packages/ariadne",
 	"packages/daedalus",
+	"packages/path-util",
 ]
 
 [workspace.package]
@@ -37,6 +38,7 @@ base64 = "0.22.1"
 bitflags = "2.9.1"
 bytemuck = "1.23.1"
 bytes = "1.10.1"
+typed-path = "0.11.0"
 censor = "0.3.0"
 chardetng = "0.1.17"
 chrono = "0.4.41"
@@ -46,6 +48,7 @@ clickhouse = "0.13.3"
 color-thief = "0.2.2"
 console-subscriber = "0.4.1"
 daedalus = { path = "packages/daedalus" }
+path-util = { path = "packages/path-util" }
 dashmap = "6.1.0"
 data-url = "0.3.1"
 deadpool-redis = "0.22.0"
@@ -239,7 +242,7 @@ codegen-units = 1 # Compile crates one after another so the compiler can optimiz
 # Specific profile for labrinth production builds
 [profile.release-labrinth]
 inherits = "release"
-panic = "unwind" # Don't exit the whole app on panic in production
+panic = "unwind"     # Don't exit the whole app on panic in production
 
 [profile.dev.package.sqlx-macros]
 opt-level = 3