Path Traversal in writeFile via Unsafe Prefix Containment Check Allows Out-of-Directory Writes

Summary: `protodump` uses descriptor-controlled paths (`name/go_package`) in output filename construction and then enforces containment with a lexical `strings.HasPrefix` check after `EvalSymlinks`. That check is bypassable with `../` traversal into existing prefix-matching sibling directories, …

name = b'../out_pwn/evil.proto'
with open('/tmp/evil.bin', 'wb') as f:
    f.write(bytes([0x0a, len(name)]) + name + b'\x00')