Security: Path injection in DummyPayloadStorage (CodeQL alert #4)

CodeQL alert #4 · rule java/path-injection · severity high (dev-mode only in practice) File: `core/src/main/java/com/netflix/conductor/core/storage/DummyPayloadStorage.java`

Sub-issue of #1010.

Problem

`download(String path)` builds `new File(payloadDir, path)` with no validation, so a `../`-style path can escape `payloadDir`. Only active when no external payload storage (S3/GCS/etc.) is configured, so exposure is limited to dev/default mode — but it's still an unvalidated filesystem path.

Fix direction

Mirror the fix already merged for `MockExternalPayloadStorage` in #723: normalize the path and verify the canonical path stays within `payloadDir` (canonical-prefix check), throwing on escape. Apply to all methods that resolve `path` against `payloadDir`.