fix(npm): ignore invalid package bin targets (#36354)
Package bin setup accepted empty, absolute, and parent-escaping target
paths. Depending on the path, this could create a bin entry for a file
that did not belong to the package or update that file’s executable
bits.
Ignore invalid target paths before bin collection and setup, with checks
at the Unix link and Windows shim boundaries as well. Valid relative
targets and existing bin-name normalization are unchanged.
Tests:
- cargo test -p deno_npm_installer --lib
- cargo check -p deno_npm_installer --all-targets
- ./x test-spec invalid_bin_targets
- ./x test-spec bin_entries_re_setup
- ./x test-spec bin_entries_prefer_closer
