Backport CVE-2026-34591 (wheel-installer path traversal) to 1.8?

CVE-2026-34591 was fixed upstream by [`ed59537a`](https://github.com/python-poetry/poetry/commit/ed59537a) — "installer: fix path traversal (#10792)" — but the patch is not present on `1.8`. On `master` `WheelInstaller.write_to_fs()` in `src/poetry/installation/wheel_installer.py` now resolves both the scheme dir and the joined path and rejects writes that escape the target: ```python target_dir = Path(self.scheme_dict[scheme]).resolve() target_path = (target_dir / path).resolve() if not target_path.is_relative_to(target_dir): raise ValueError(f"Attempting to write {path} outside of the target directory") ``` On `1.8` the body is still the pre-fix one-liner: ```python target_path = Path(self.scheme_dict[scheme]) / path ``` so a wheel containing a `../`-prefixed file path can still be installed outside the intended scheme directory. `is_relative_to` does not appear in `src/poetry/installation/wheel_installer.py` on `1.8`, and `git compare 1.8...ed59537a` shows behind_by=49 — looks like a clean cherry-pick if `1.8` is still receiving security backports. — vulgraph