Bug: path traversal in Chroma.add_images() via unsanitized URI

### Submission checklist - [x] This is a bug, not a usage question. - [x] I added a clear and descriptive title that summarizes this issue. - [x] I used the GitHub search to find a similar question and didn't find it. - [x] I am sure that this is a bug in LangChain rather than my code. - [x] The bug is not resolved by updating to the latest stable version of LangChain (or the specific integration package). - [x] This is not related to the langchain-community package. - [x] I posted a self-contained, minimal, reproducible example. A maintainer can copy it and run it AS IS. ### Package (Required) - [ ] langchain - [ ] langchain-openai - [ ] langchain-anthropic - [ ] langchain-classic - [ ] langchain-core - [ ] langchain-model-profiles - [ ] langchain-tests - [ ] langchain-text-splitters - [x] langchain-chroma - [ ] langchain-deepseek - [ ] langchain-exa - [ ] langchain-fireworks - [ ] langchain-groq - [ ] langchain-huggingface - [ ] langchain-mistralai - [ ] langchain-nomic - [ ] langchain-ollama - [ ] langchain-openrouter - [ ] langchain-perplexity - [ ] langchain-qdrant - [ ] langchain-xai - [ ] Other / not sure / general ### Related Issues / PRs #37291 ### Reproduction Steps / Example Code (Python) ```python import chromadb from langchain_chroma import Chroma store = Chroma(client=chromadb.Client(), embedding_function=None) store.add_images(uris=["../../../../etc/passwd"]) # reads the file and returns content base64-encoded — no error raised ``` ### Error Message and Stack Trace (if applicable) ```shell I'm trying to use Chroma.add_images() with image URIs. I expect a ValueError when a URI points outside the intended directory. Instead, it opens any file on the filesystem — including sensitive system files — and returns the contents base64-encoded through the embeddings pipeline. Root cause: encode_image() calls Path(uri).open("rb") with no path validation. The uris parameter is part of the public API and accepts any caller-supplied string. I have a working fix +…