Function ensure_within_root 

fn ensure_within_root(
    allowed_root: &Path,
    candidate: &Path,
    label: &str,
    orig: &Path,
) -> Result<()>

Verify that candidate resolves (after following symlinks) to a path that lives inside allowed_root. Protects against src/test/lib/etc. being symlinks that escape the project root.

label and orig are only used for error messages.