Harden serve-client-library Vite plugin: path traversal fix, proper content types, and build error output

[Copilot]

Addresses security and correctness issues in the serve-client-library Vite dev plugin introduced for serving @wp-playground/client at /client/.

Changes

• Path traversal prevention: Parse req.url via new URL() to strip query strings before building the filesystem path, then use path.relative() + isAbsolute() to assert the resolved path stays within clientDistDir — returns 403 otherwise.
• Content-type by extension: Replaced the hard-coded application/javascript with an extension map covering .js, .cjs, .json, and .map; falls back to application/octet-stream.
• Static child_process import: Replaced the inline require('child_process') call with a top-level import { exec } from 'node:child_process', improving type safety and ESM compatibility.
• Build error visibility: The exec callback now captures stderr and forwards it to the Vite logger so build failures surface actionable output instead of a generic message.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.