fix(zora): confine local image paths and reject non-https remotes

[SashaMIT]

Summary

Twin of #1424 (flaunch). Zora generateZoraTokenUri treated any image that was not ipfs:// or https:// as a local file path and fs.readFiled it before Pinata upload. Absolute paths (e.g. /etc/passwd) and http:// URLs fell through that path.

This PR:

• confines local paths to process.cwd() via realpath
• rejects other URI schemes (including http://) instead of reading them as files

Test plan

• npx jest --testPathPattern=zora/utils (2 passed)
• Manual: https:// / ipfs:// coin create still works; absolute local escape fails closed

Made with Cursor

[cb-heimdall]

🟡 Heimdall Review Status

Requirement	Status	More Info
Reviews	🟡 0/1	Denominator calculation Show calculation 1 if user is bot 0 1 if user is external 0 2 if repo is sensitive 0 From .codeflow.yml 1 Additional review requirements Show calculation Max 0 0 From CODEOWNERS 0 Global minimum 0 Max 1 1 1 if commit is unverified 0 Sum 1

[SashaMIT]

Consolidating our open queue to reduce triage load. Closing this for now; the core set we are keeping open is #1392, #1404, #1405, #1409, #1421, #1423. Happy to reopen or refile this specific fix if a maintainer wants it.