Fix CWE-94 Unsafe Dynamic Module Loading vulnerability

[kolega-dev-github-app]

Summary

This PR fixes a high-severity security vulnerability (CWE-94: Unsafe Dynamic Module Loading) in the OpenClaw hook system that could allow arbitrary code execution through path traversal and malicious hook modules.

Changes

• Implemented comprehensive path validation with defense-in-depth approach in a new validateModulePath() function
• Added security checks for path canonicalization, directory containment, extension whitelisting, symlink detection, and pattern matching
• Updated hook loader functions to use the new secure path validation before dynamic module imports

Testing

The fix has been thoroughly tested to ensure it addresses the root cause, follows security best practices, maintains existing code style, and does not introduce new vulnerabilities.