feat: add path validation options to restore action

restore/action.yml

@@ -23,6 +23,23 @@ inputs:
     description: 'Check if a cache entry exists for the given input(s) (key, restore-keys) without downloading the cache'
     default: 'false'
     required: false
+  strict-paths:
+    description: |
+      Controls client-side validation of cache archive entry paths before extraction.
+      'off' disables validation (legacy behavior). 'warn' logs a single warning when any
+      entry would resolve outside the declared `path` inputs and still extracts the cache.
+      'error' rejects the cache with a CacheIntegrityError and skips extraction entirely.
+      Default is 'warn'.
+    default: 'warn'
+    required: false
+  fail-on-cache-invalid:
+    description: |
+      Fail the workflow if the restored cache is rejected by client-side path validation
+      (entries that escape the declared paths, or an archive that cannot be parsed).
+      Only applies when `strict-paths` is 'error'; the 'off' and 'warn' modes never
+      reject a cache. When 'false' (default), a rejected cache is treated as a cache miss.
+    default: 'false'
+    required: false
 outputs:
   cache-hit:
     description: 'A boolean value to indicate an exact match was found for the primary key'