Sanitize buffered upload filenames

[harsh21234i]

Description

close #6752
Buffered uploads previously preserved client-supplied path segments in UploadFile.path, while streamed uploads
normalized filenames to a basename.

This made rx.upload_files and rx.upload_files_chunk expose different filename/path behavior for the same multipart
filename, for example ../secret.txt.

This PR adds one shared filename sanitizer and uses it for both upload paths.

Changes

• Add _sanitize_upload_filename to strip path segments from upload filenames.
• Add _upload_file_from_starlette so buffered upload file construction is directly testable.
• Use the shared sanitizer in both buffered and streamed upload handling.
• Add tests for POSIX-style and Windows-style path segment filenames.

Checks

• uv run pytest tests/units/components/core/test_upload.py -q
• uv run ruff check packages/reflex-components-core/src/reflex_components_core/core/_upload.py tests/units/ components/core/test_upload.py
• uv run ruff format --check packages/reflex-components-core/src/reflex_components_core/core/_upload.py tests/units/ components/core/test_upload.py
• uv run pyright packages/reflex-components-core/src/reflex_components_core/core/_upload.py tests/units/components/ core/test_upload.py

[greptile-apps]

Greptile Summary

This PR makes buffered and streamed uploads use the same filename sanitization. The main changes are:

• Adds a shared cross-platform basename sanitizer.
• Uses the sanitizer for buffered and streamed uploads.
• Adds tests for POSIX and Windows path-style filenames.
• Adds a bug-fix news entry.

Confidence Score: 5/5

This looks safe to merge.

• The shared sanitizer keeps buffered and streamed filename behavior consistent.
• No blocking issue remains in the updated code.

Important Files Changed

Filename	Overview
packages/reflex-components-core/src/reflex_components_core/core/_upload.py	Adds shared basename sanitization and applies it to both upload paths.
tests/units/components/core/test_upload.py	Adds direct tests for filename sanitization in buffered and streamed uploads.
packages/reflex-components-core/news/6753.bugfix.md	Documents the corrected filename behavior for buffered uploads.

_{Reviews (2): Last reviewed commit: "Add upload filename changelog fragment" | Re-trigger Greptile}

[codspeed-hq]

Merging this PR will not alter performance

✅ 26 untouched benchmarks
⏩ 8 skipped benchmarks¹

---

_{Comparing harsh21234i:fix/upload-filename-basename-buffered (0d53001) with main (11f8a7a)}

Footnotes

1. 8 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[masenf]

it seems like this breaks directory upload.

if you make an upload component, then drag a whole directory onto it and upload it, i would expect the path segments to be retained.