Fix use of tmp.dir() with `dir` option

fix: check for relative values

The relative-value guard in `_assertPath` calls `.includes('..')` directly on
the user-supplied value. When the value is an Array the call checks element
equality (so `['../escape'].includes('..')` is false), and when the value is
an arbitrary object a duck-typed `includes` returning false defeats the check
entirely. In both cases the value is subsequently coerced to a string by
`Array.prototype.join` inside `_generateTmpName` and by `path.join`, so a
non-string carrying `../` still produces a path that escapes `tmpdir`.

Tighten `_assertPath` to require `typeof value === 'string'` before the
substring check, and apply the same type check to `template` ahead of the
existing `XXXXXX` regex match (otherwise `match` throws on a non-string with
an unrelated error). The error includes the option name so consumers can see
which option was wrong.

Adds a `test/GHSA-7c78-jf6q-g5cm-test.js` that exercises array, duck-typed
object, and primitive (number) inputs across `fileSync`, `dirSync`, and
`tmpNameSync`, and asserts that valid string inputs are still accepted.

Signed-off-by: tonghuaroot <tonghuaroot@gmail.com>

Reject non-string prefix, postfix, template