Reject paths in .tool-versions (#1007)

## Summary
- reject path-like uv versions from `.tool-versions`
- reject path-like Python versions from `.tool-versions`
- document the restriction and cover Unix and Windows paths in tests

## Testing
- `npm ci --ignore-scripts`
- `npm run all`

Refs: pi-session 019ff4bb-8b7c-7c4b-8bdf-7c188dfa2e3f

src/version/tool-versions-file.ts

@@ -10,6 +10,12 @@ export function getUvVersionFromToolVersions(
   }
 
   const version = stripVersionPrefix(versions[0]);
+  if (isPath(version)) {
+    core.warning(
+      `The uv version ${versions[0]} in .tool-versions is not supported. Paths are not allowed.`,
+    );
+    return undefined;
+  }
   if (version.startsWith("ref")) {
     core.warning(
       "The ref syntax of .tool-versions is not supported. Please use a released version instead.",
@@ -37,7 +43,8 @@ export function getPythonVersionFromToolVersions(
   if (
     version === "system" ||
     version.startsWith("ref:") ||
-    version.startsWith("path:")
+    version.startsWith("path:") ||
+    isPath(version)
   ) {
     core.warning(
       `The Python version ${versions[0]} in .tool-versions is not supported. The Python entry will be ignored.`,
@@ -73,3 +80,7 @@ function getToolVersions(
 function stripVersionPrefix(version: string): string {
   return version.startsWith("v") ? version.slice(1) : version;
 }
+
+function isPath(version: string): boolean {
+  return version.includes("/") || version.includes("\\");
+}