security: fix vulnerabilities and update security hardening (2026-03-12)

Code security fixes:
- Fixed 3 critical auth bypass bugs (user.jso, typo → user.json) in RenameFile, NewFolder, DeleteFolder API routes
- Added URL validation (HTTP/HTTPS only) on ProfilPicture and BackgroundCustom endpoints to prevent stored XSS/CSS injection
- Added path traversal protection in Upload.js (resolved path boundary check)
- Removed unsafe-eval from CSP script-src directive
- Removed information disclosure in BuildMetaData error responses
- Removed unused child_process import in BuildMetaData.js

Version bump: 1.2.1-beta → 1.2.2-beta

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cdn-app/insider-myaxrin-labs-dinawo",
-  "version": "1.2.1-beta",
+  "version": "1.2.2-beta",
   "description": "",
   "main": "server.js",
   "scripts": {