[code-scanning-fix] Fix go/bad-redirect-check: incomplete leading-slash validation in manifest path check (#56219)

* Fix CWE-601 bad redirect/path check in cleanManifestRelativePath

Reject paths starting with '//' or '/\\' in addition to a single
leading slash or backslash, since these are treated as absolute/
protocol-relative references by many consumers.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Fix unreachable path guard and add regression coverage

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Peli de Halleux <pelikhan@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>