fix(api_core): improve rest path validation

[daniel-sanche]

Context: b/532254612

[gemini-code-assist]

Code Review

This pull request introduces path traversal validation and percent-encoding for variables within path templates in google/api_core/path_template.py, along with corresponding unit tests. The feedback highlights a potential security bypass in _extract_and_validate_wildcards where path traversal sequences (like projects/..) could bypass validation if the value does not match the sub-template or if the template is single-segment. It is recommended to apply _validate_multi_segment_value to these edge cases and add tests to verify that these bypasses are successfully blocked.

[chalmerlowe]

Some comments and suggestions.

[daniel-sanche]

Converting this to draft, because it sounds like there are still some cross-language discussions happening

[hebaalazzeh]

LGTM

[chalmerlowe]

LGTM