Fix | Scope repo-server local Helm streams

[dag-andersen]

Summary

• Fixes Bug | repo-server-api mode streams files outside the chart, rejects on out-of-bounds symlinks #438
• Stream only the local Helm chart directory for repo-server-api rendering instead of the whole branch root
• Keep branch-root streaming for Kustomize, plugins, and Kustomize with Helm support
• Add regression coverage for unrelated repo symlinks being excluded from the streamed tarball

Testing

• make run-lint
• go test ./pkg/reposerverextract/...
• go test ./pkg/...
• TEST_CASE="branch-1/target-1" go test -v -timeout 10m -run TestSingleCase ./... from integration-test