Validate downloaded model manifest paths before writing files

[cryptedx]

Hi, the model downloader currently trusts the paths from openmed-mlx.json and uses them directly when building local destination paths.

This is probably fine as long as the Hugging Face model repo is trusted, but it would be safer to validate those paths before writing anything to disk. If the manifest ever contained an absolute path or .. segments, the app could potentially write files outside of the intended model cache directory.

Relevant code:

• HideMyData/ModelDownloader.swift

Suggested fix:

• reject absolute paths
• reject paths containing ..
• resolve/canonicalize the final destination
• make sure the final destination is still inside the expected model cache directory
• ideally fail the download with a clear error if the manifest contains an invalid path

This would make the model download flow more robust and reduce the risk from a compromised or malformed remote manifest.

[mkbula]

The app is sandboxed either way, so im not sure whether this makes sense to do. Also, currently there's just a single model download. I might add validation once I add model management or something like that.