Corpus: add path-traversal (CWE-22) cases for Go and Java

[bkd-dotcom]

Add path-traversal corpus cases so CWE-22 is covered beyond Python/PHP.

Where: umbra_eval/detection/corpus/multilang.py (or public.py).

• Go: os.Open("/data/" + r.URL.Query().Get("f")) (and a taint-through-var form).
• Java: new File(baseDir, req.getParameter("name")) / Files.readAllBytes(...).
• SAFE decoys: input validated/canonicalized against a base dir.

Acceptance criteria

• Vulnerable cases detected as path_traversal / CWE-22; SAFE cases 0 FP.
• pytest -q + ruff green.

See CONTRIBUTING.md. If the engine misses a case, that's a valid finding — open a
companion umbra-core issue rather than hand-tuning to one case.

[ShubhaKC123]

Hi, I'd like to work on this issue.

[bkd-dotcom]

Sure, you can start working by forking the repo.

[bkd-dotcom]

Done in #31 (merged).

LANG-56-go-path-traversal and LANG-57-java-path-traversal (CWE-22), plus a LANG-58-SAFE-go-constant-path decoy so a compiled-in path is not counted as traversal.

These needed detection rules first: main had no Go or Java path-traversal rule, so a corpus case would have dropped recall below the 1.0 the eval suite asserts. Added as go.taint.path_traversal / java.taint.path_traversal in Signetry/core#95 (shipped in core v0.7.0).

Corpus is now 60 cases at recall 1.0 with 0 false positives, verified against the published core v0.7.0 tag in a clean environment.