fix(node): validate resolved main path stays within package directory (#33170)
## Summary
- Adds path validation to `legacy_main_resolve` to ensure the resolved
`main` field from `package.json` doesn't resolve outside the package
directory
- This matches the existing validation already present in
`resolve_package_target_string` for `exports` field resolution
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>