Fix 5 CodeQL alerts: world-writable files (CWE-732) and path injectio… #53

Job	Run time
Build & Test (Windows / MSVC)	4m 30s
UBSan (Ubuntu)	2m 16s
Server Codecs (Ubuntu)	4m 12s
ASan + UBSan (Ubuntu)	3m 43s
TSan (Ubuntu)	2m 54s
Secrets Scan (gitleaks)	6s
Fuzz (Ubuntu, Clang-18)	30m 45s
Post-Quantum PQ (Ubuntu)	3m 39s
License Compliance	1m 26s
Mutation Testing Baseline (Ubuntu)	21s
Build & Test (macos-14)	2m 32s
Full Suite 394/394 (Ubuntu)	4m 17s
Build & Test (ubuntu-24.04)	2m 58s
Benchmarks (Ubuntu)	9m 36s
Python SAST (bandit)	7s
Coverage (Ubuntu, Clang-18)	2m 14s
	1h 15m 36s

Provide feedback