fix: harden JSON parsing and path handling in PAM extend

[jlima8900]

Summary

• Strip NUL bytes from folder paths before placeholder substitution
• Replace bare except on JSON parse with specific exception handlers
• Canonicalize import file path with os.path.realpath()

Test plan

• Tested on Python 3.7 and 3.12

[aaunario-keeper]

Suggestions to consider:

If there's a defined "safe directory" for import files (not sure if there is, but that would be a good hardening improvement), add a path confinement check after realpath.
Optionally add data = {} before the try block to satisfy static analysis tools, even though it's not strictly required at runtime.

[jlima8900]

Thanks for the review! Two thoughts:

Path confinement: Commander is a CLI tool where users explicitly pass file paths as arguments — adding a safe directory restriction would limit usability since users should be able to point at any path on their filesystem. The realpath() call already neutralizes symlink traversal and ../ manipulation, which is the appropriate level of hardening for a CLI context. Path confinement is more suited to web services where input comes from untrusted sources.

data = {} before try: In the refactored version, every path either succeeds (assigns data) or raises CommandError — there's no code path where data is unbound. Adding the pre-assignment would imply a silent fallback that no longer exists, which could be more confusing than helpful.