Fix presubmit and postsubmit path handling vulnerabilities (#2917)

Addresses b/569811973.

- `bcr_presubmit.py`: Uses `git diff -z` to parse quoted paths
correctly, preventing a bypass of symlink validations.
- `bcr_postsubmit.py`: Verifies that the resolved path of the
destination attestation file is contained within the expected output
directory using `pathlib.Path.resolve()`, preventing arbitrary file
writes via malicious symlinks.