fix(mocks): keep the mock hook reader inside the Drive

mockHookSource resolves the hook value against the Drive and eval()s what
it finds. A hook value carrying '..' segments resolved outside files/ -
mock-only, but the value is hand-edited mock config. Refuse anything that
does not resolve under files/.

sas/mocks/sasjs/services/dcMockUtils.js

@@ -366,6 +366,11 @@ function mockHookSource(hookValue) {
     // sitting in the same place on the Drive.
     hook = hook.replace(/\.sas$/i, '')
     const hookFile = nodePath.resolve(driveRoot, 'files', appLoc, hook + '.js')
+    // The hook value is hand-edited mock config, and a value carrying '..'
+    // segments would otherwise resolve outside the Drive and be eval()'d
+    // in-service. Keep it inside the Drive's files tree.
+    const filesRoot = nodePath.resolve(driveRoot, 'files')
+    if (!hookFile.startsWith(filesRoot + nodePath.sep)) return null
     if (!fs.existsSync(hookFile)) return null
     return fs.readFileSync(hookFile, 'utf8')
 }