fix: enforce server trust boundaries

scripts/build-thothctl.sh

@@ -2,7 +2,14 @@
 set -euo pipefail
 
 repository_root=$(cd "$(dirname "$0")/.." && pwd)
-output_directory="$repository_root/dist/thothctl"
+output_directory="${THT_THOTHCTL_OUTPUT_DIRECTORY:-$repository_root/dist/thothctl}"
+
+if [[ "$output_directory" != /* || "$output_directory" == / || "$output_directory" == */ ||
+      "$output_directory" == *//* || "/$output_directory/" == */../* ||
+      "/$output_directory/" == */./* ]]; then
+  echo "THT_THOTHCTL_OUTPUT_DIRECTORY must be an absolute canonical path" >&2
+  exit 2
+fi
 
 mkdir -p "$output_directory"
 docker build --file "$repository_root/docker/thothctl.Dockerfile" --output "type=local,dest=$output_directory" "$repository_root"