fix: use the content directory for temp files to prevent cross-device linking (will not result in a bug or vulnerability because the server never looks in the root for content files)

src/bin/upload.rs

@@ -110,7 +110,7 @@ async fn main() -> Result<(), MainError> {
     let mut compressor =
         BrotliEncoder::with_quality(for_compressor, async_compression::Level::Best);
 
-    let (temp_file, temp_path) = NamedTempFile::new()
+    let (temp_file, temp_path) = NamedTempFile::new_in(content_directory)
         .context(TempFileCreationSnafu)?
         .into_parts();