Restrict path traversal level 1 file access

[r1kka6]

Summary

• require Level 1 file names to match the existing allowed file list exactly
• block direct secret-file reads and ../ traversal into adjacent resource directories
• update the Level 1 unit test to assert secure rejection of disallowed file names

Verification

• ./gradlew compileJava test spotlessJavaCheck bootJar --no-daemon passed in an eclipse-temurin:17-jdk container
• vulnerable baseline returns secret.json content and ../JWT/SymmetricAlgoKeys.json content
• patched runtime returns isValid=false for both while UserInfo.json remains readable