adk web GET/DELETE test endpoints skip the create_test path sanitiser

[Oskii]

Expected Behavior

create_test strips directories from test_name with os.path.basename so a name cannot leave the app tests/ folder.

GET, DELETE, and rebuild of a single test should use the same rule.

Actual Behavior

On main @ b018062, only create_test calls os.path.basename. delete_test, get_test_content, and rebuild_app_tests join test_name as given.

A percent-encoded path segment ../outside.json (%2e%2e%2foutside.json) on DELETE/GET is joined onto tests/ and can read or remove a JSON file in the agent directory, outside tests/.

rebuild?test_name=../outside.json does the same for the rebuild path.

This is the local adk web server. It is unauthenticated. Default bind is loopback. It still matters when --host 0.0.0.0 is used, or when anything else can hit those routes.

Steps to Reproduce

1. adk web (or the TestClient in tests/unittests/cli/test_adk_web_server_tests.py)
2. Put outside.json in the agent directory, not in tests/
3. DELETE /dev/apps/<app>/tests/%2e%2e%2foutside.json
4. On current main, that file is removed. After sanitising with basename, the request 404s and the file stays.

I can send a PR that shares one helper with create_test and adds those cases to test_adk_web_server_tests.py.

[surajksharma07]

@Oskii Delete/get/rebuild all skip the basename check create_test already does, confirmed it lands one directory above tests/. Tried the shared-helper approach from #7034 locally and it closes the gap cleanly, traversal attempts now just 404 instead of touching anything outside tests/. Only thing worth double checking before review and merge is a dedicated traversal test on the GET path specifically since your testing plan calls out delete and rebuild but not get by name.

[Oskii]

@surajksharma07 Added a dedicated test_get_test_rejects_path_traversal on #7034 (same encoded ../ as DELETE, own test so GET is not only a side assertion). Rebuild already had its own case.