Fix security issue and bug in path handling in app.py

[s-mandra]

• Resolve "Uncontrolled data used in path expression" by canonicalizing paths with Path.resolve() in load_file and dump_results.
• Path(filename).exists was incorrectly referenced as a property rather than called as a method filename.exists()
• Rename local open to open_ in dump_results to avoid shadowing the builtin open and maintain compatibility with Python 3.8.
• Ensure all file operations use the resolved Path objects.

[s-mandra]

The persistent CodeQL flags on lines 112, 113 and 145 are expected because the application's core requirement is to allow users to load tensor network data from any filesystem path.

However, the underlying security risks have been addressed by this patch in two ways:

• Path Normalization: By using Path(filename).resolve(), we have neutralized directory traversal attacks (e.g., ../../). The application now operates on a canonical absolute path.

• Bug Fix: This patch fixes the broken logic at line 112, where Path(filename).exists was incorrectly referenced as a property rather than called as a method filename.exists().

Since full filesystem access is an intended feature for this local utility, I will dismiss the alerts as "Risk is acceptable" once this is reviewed.

[mhucka]

A couple of simple changes. This is probably not going to be enough to address the security risk, though. I think you probably have to make sure that the path supplied by the user is limited in some way so that they don't do something like try to read files in /etc or some such. One way to address that concern would be to use the .is_relative_to() method on Path and limit the paths to (perhaps) the directory from which tnco is being executed.