[gr8man]

Description

FileHandler builds the path of a cache item by appending the validated key to the cache store path:

$this->path . $key

BaseHandler::validateKey() rejects /, \ and .. only indirectly, through Config\Cache::$reservedCharacters. That setting is often emptied when a single key namespace is shared by several handlers (for example file storage alongside Redis/Memcached), and in that case a key such as ../foo or sub/key reaches the file system unchanged, allowing a write/read/unlink outside the cache directory (path traversal).

This PR makes the file handler's own validation authoritative, independently of $reservedCharacters:

• FileHandler::validateKey() now rejects /, \, the null byte, and traversal sequences (..) in both the key and the prefix, and throws CodeIgniter\Exceptions\InvalidArgumentException.
• Valid keys keep the existing behaviour: PSR-6 checks from BaseHandler::validateKey() (string type, non-empty, configured reserved characters) and MD5 hashing when the prefixed key exceeds MAX_KEY_LENGTH.
• Regression tests cover traversal with and without separators, both separators, a null byte, a traversal sequence in the prefix, and a valid key; the test restores reservedCharacters so it does not leak state into other tests.

Fixes the traversal vector without requiring applications to configure reservedCharacters.

Checklist:

• Securely signed commits
• Component(s) with PHPDoc blocks, only if necessary or adds value (without duplication)
• Unit testing, with >80% coverage
• User guide updated
• Conforms to style guide