GHSA-C5XX-H28H-F682 obsidian-tc : Symlink read-ACL scope bypass via lexical path checks

Impact ACL checks ran on the lexical vault-relative path while containment used the realpath. An in-vault symlink placed under an allowed glob, whose realpath resolved into a denied folder, passed the read ACL — an intra-vault read-ACL-scope bypass. It requires an out-of-band-planted symlink no M...