Reject requested O2PDPSuite tags with unsafe characters

This fixes resolve_o2pdpsuite_tag accepting a requested tag containing
path-traversal characters, and makes the harness executable like its
siblings.

- A "sim-tests-tag:" value taken from a fork PR's body could contain
  "../" and select a module outside O2PDPSuite, since only -e was
  checked before use.
- Added a character-class check that rejects anything but
  [A-Za-z0-9._-] before the existence test.
- Added a harness case asserting a requested value of "../O2/something"
  returns 1 and prints nothing on stdout.
- chmod +x test/tests/resolve_tag.sh; it was 644 while its siblings are
  755. test/ci/resolve_tag.sh stays 644, since it is sourced, not run.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: sawenzel

test/ci/resolve_tag.sh

@@ -14,6 +14,11 @@ resolve_o2pdpsuite_tag()
     fi
 
     if [[ -n "${requested}" ]] ; then
+        case ${requested} in
+            *[!A-Za-z0-9._-]* )
+                echo "resolve_o2pdpsuite_tag: invalid tag: ${requested}" >&2
+                return 1 ;;
+        esac
         if [[ ! -e "${moduledir}/${requested}" ]] ; then
             echo "resolve_o2pdpsuite_tag: requested tag not available: ${requested}" >&2
             return 1

test/tests/resolve_tag.sh

@@ -48,6 +48,14 @@ mkdir -p "${TMP}/empty"
 out=$(resolve_o2pdpsuite_tag "${TMP}/empty" 2>/dev/null) ; rc=$?
 check "directory with no dailies fails" 1 "${rc}"
 
+# A requested tag from a fork PR's body must not be able to escape the
+# O2PDPSuite module directory via "..".
+mkdir -p "${TMP}/O2"
+touch "${TMP}/O2/something"
+out=$(resolve_o2pdpsuite_tag "${D}" "../O2/something" 2>/dev/null) ; rc=$?
+check "path traversal tag fails" 1 "${rc}"
+check "path traversal tag prints nothing on stdout" "" "${out}"
+
 echo
 if [[ "${FAILURES}" == "0" ]] ; then
     echo "All resolve_tag tests passed"