[release-12.0.1] Apply security patch 357-202503311017.patch (#104493)

Apply security patch 357-202503311017.patch (#104490)

* Sanitize paths before evaluating access to route

* use util.CleanRelativePath

---------

Co-authored-by: Andres Martinez Gotor <andres.martinez@grafana.com>
(cherry picked from commit 1f707d16ed)

Co-authored-by: Yuri Tseretyan <yuriy.tseretyan@grafana.com>

pkg/api/pluginproxy/ds_proxy_test.go

@@ -274,6 +274,14 @@ func TestDataSourceProxy_routeRule(t *testing.T) {
 				err = proxy.validateRequest()
 				require.NoError(t, err)
 			})
+
+			t.Run("path with slashes and user is editor", func(t *testing.T) {
+				ctx, _ := setUp()
+				proxy, err := setupDSProxyTest(t, ctx, ds, routes, "//api//admin")
+				require.NoError(t, err)
+				err = proxy.validateRequest()
+				require.Error(t, err)
+			})
 		})
 
 		t.Run("plugin route with RBAC protection user is allowed", func(t *testing.T) {