fix(policy): resolve project_root before path-traversal check

[qorexdevs]

Description

_get_cache_dir passes an unresolved project_root to ensure_path_within, which then resolves candidate and base_dir independently. On Windows, Path.resolve() on an existing path expands 8.3 short names (e.g. RUNNER~1 -> runneradmin) and may add the \?\ extended-length prefix, but on a not-yet-existing path it keeps the original form. When candidate doesn't exist yet (first writer in a concurrent scenario), the two sides resolve to different forms and is_relative_to fails with PathTraversalError.

Two changes:

• discovery.py: resolve project_root once at the top of _get_cache_dir so the candidate path inherits the long-name form
• path_security.py: strip the \?\ extended-length prefix in ensure_path_within before comparison, since Windows resolve() adds it inconsistently

Fixes #886

Type of change

• Bug fix
• New feature
• Documentation
• Maintenance / refactor

Testing

• Tested locally
• All existing tests pass (472 policy unit tests green)
• Added regression test (test_unresolved_project_root_does_not_raise) that passes a symlink-indirect project root through _get_cache_dir

[qorexdevs]

@microsoft-github-policy-service agree