fix: reject unsafe package metadata paths

[sapunyangkut]

• fixes Absolute or relative path in image should not pass validation #1591

Summary

• reject absolute, parent-relative, UNC, drive-qualified, and unsupported-scheme paths in package metadata
• cover image as well as the equivalent path fields in contributors, licenses, and sources
• preserve the supported remote scheme allowlist and report malformed URLs as validation errors

Root cause

Package.metadata_validate() checked unsafe resource schema paths in untrusted mode, but it did not apply equivalent checks to package-level metadata paths. As a result, local absolute or parent-relative paths and unsupported schemes could pass validation. A malformed URL could also escape validation by raising ValueError from urlparse().

Validation

• python -m pytest frictionless/package/__spec__/test_security.py -q — 122 passed, 2 skipped
• python -m ruff check frictionless/package/package.py frictionless/package/__spec__/test_security.py
• python -m ruff format --check frictionless/package/package.py frictionless/package/__spec__/test_security.py
• git diff --check

An additional run of the full frictionless/package/__spec__ directory was attempted, but it exceeded a 120-second local limit without reporting an assertion failure. The focused 124-case security module completed successfully.

AI disclosure

This Draft PR was prepared and validated by an automated AI coding agent. The agent identified the root cause, produced the patch and tests, ran the checks listed above, and opened this Draft PR. It has not yet received human or maintainer review.