Cache archive symlinks restored; git argument injection prevented

<!-- Release notes generated using configuration in .github/release.yml at v2.9.18 -->

What's Changed

Changelog

• release(turborepo): 2.9.17 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/13047
• ci: Fetch version.txt via API in docs alias failure notification by @anthonyshew in https://github.com/vercel/turborepo/pull/13050
• fix: Harden cache archive symlink restore by @anthonyshew in https://github.com/vercel/turborepo/pull/13051
• chore: Remove web UI mode by @anthonyshew in https://github.com/vercel/turborepo/pull/13052
• fix: Harden query server file access by @anthonyshew in https://github.com/vercel/turborepo/pull/13053
• fix: Confine prune patch paths by @anthonyshew in https://github.com/vercel/turborepo/pull/13054
• fix: Prevent git argument injection in SCM refs by @anthonyshew in https://github.com/vercel/turborepo/pull/13055
• fix: Strip special mode bits from cache restore by @anthonyshew in https://github.com/vercel/turborepo/pull/13056
• fix: Contain incremental cache outputs by @anthonyshew in https://github.com/vercel/turborepo/pull/13057
• fix(turborepo): Normalize Windows daemon path hash by @Balance8 in https://github.com/vercel/turborepo/pull/13020
• fix: Preserve vt100 cell byte counts by @anthonyshew in https://github.com/vercel/turborepo/pull/13058
• fix: Separate artifact signature fields by @anthonyshew in https://github.com/vercel/turborepo/pull/13059
• fix: Validate OidHash hex buffers by @anthonyshew in https://github.com/vercel/turborepo/pull/13060
• fix: Block self-hosted login URLs from attempting to use Vercel's SSO by @anthonyshew in https://github.com/vercel/turborepo/pull/13061

New Contributors

• @Balance8 made their first contribution in https://github.com/vercel/turborepo/pull/13020

Full Changelog: https://github.com/vercel/turborepo/compare/v2.9.17...v2.9.18