[BUG] Incorrect lexical prefix checks allow path containment bypass in filesystem trust boundaries

## Description Several filesystem trust boundary validations in nuclei relied on **lexical prefix checks** to determine whether a path falls under an allowed directory. This approach is incorrect because sibling paths with a common prefix can be incorrectly treated as children of trusted directories, leading to path containment bypass. ## Affected Areas - Helper payload loading - Template archive extraction - Custom template metadata - Template path classification - Headless screenshot output validation ## Expected Behavior Path containment checks should use **canonical (resolved) paths** to correctly determine whether a given path is a child of a trusted directory, accounting for symlinks, `.`, `..`, and similar edge cases. ## Actual Behavior Lexical string prefix checks (e.g., `strings.HasPrefix`) are used instead of canonical path resolution. This means a path like `/trusted-dir-evil` could be mistakenly accepted as being under `/trusted-dir` depending on the implementation. ## References - Related PR: https://github.com/projectdiscovery/nuclei/pull/7420 - Reported by: @dwisiswant0