OpenAPI3 version value escapes `emitterOutputDir` and overwrites YAML/JSON outside the output tree
The @typespec/openapi3 emitter retains the value of a @versioned enum member and interpolates it into the output filename as {version} without sanitizing path separators or traversal components. The completed path reaches the compiler's emitFile(), which creates the parent directory and writes the file without verifying containment under emitterOutputDir. A crafted declarative .tsp input can therefore create or overwrite an OpenAPI-formatted .yaml or .json file outside the configured output tree, subject …