GHSA-c656-jcx2-7pqj zrok copy writes attacker-controlled WebDAV paths outside the destination root

• Go github.com/openziti/zrok/v2: < 2.0.3 → fixed in 2.0.3 • Go github.com/openziti/zrok: >= 0.4.23, <= 1.1.11 (no fix yet)

Summary Alice runs `zrok2 copy` from a WebDAV or zrok drive controlled by Bob into a local filesystem target. Bob returns a DAV `href` such as `/../outside.txt`. The sync pipeline stores that path in the source inventory and passes it to `FilesystemTarget.WriteStream`, which joins it with the target root and creates the file outside Alice's selected directory. Impact Users given access to a zrok share may be able to traverse the directory tree arbitrarily with the sharing users credentials, allowing for sensitive information to be overwritten.