fix(web): require clone dir strictly under build_vms on remove (W6)

remove_vm() deletes vmx.parent, so containment must check the clone dir, not just the vmx: a crafted vmx_id of build_vms/x.vmx passed the old check and would rmtree the entire clone base. Now the parent must be strictly inside build_vms.

src/ci_orchestrator/web/routes.py

@@ -197,7 +197,12 @@ async def vms_remove(
     config: Config = request.app.state.config
 
     vmx = _decode_vmx_id(vmx_id)
-    if vmx is None or not _is_contained(vmx, config.paths.build_vms):
+    # remove_vm() deletes vmx.parent (the clone dir), so the *clone dir* — not
+    # merely the vmx — must be STRICTLY inside build_vms. Checking vmx.parent
+    # rejects a crafted ``build_vms/x.vmx`` whose parent IS build_vms itself,
+    # which would otherwise rmtree the entire clone base. build_vms being an
+    # ancestor of vmx.parent also implies vmx is contained.
+    if vmx is None or not _is_contained(vmx.parent, config.paths.build_vms):
         raise HTTPException(
             status_code=status.HTTP_400_BAD_REQUEST,
             detail="vmx path is not contained in config.paths.build_vms",