GHSA-33r3-4whc-44c2: Path traversal in vite-plus/binding downloadPackageManager() writes outside VP_HOME

downloadPackageManager() in vite-plus/binding accepts an untrusted version string and uses it directly in filesystem paths. A caller can supply ../ segments to escape the VP_HOME/package_manager/<pm>/ cache root and cause Vite+ to delete, replace, and populate directories outside the intended cache location.