Suppress validated preview path CodeQL false positive

[DeusExTaco]

Summary

• document the validated preview path helper before the lexical path operation
• add a narrow CodeQL suppression for the already-constrained preview path false positive
• keep permissions-preview behavior unchanged

Verification

• pytest tests/utilities/test_library_permissions_preview.py tests/api/test_utilities_preview_api.py tests/unit/test_mass_rename_preview_builder.py -q
• ruff check src/pullbox/utilities/preview_builders.py
• ruff format --check src/pullbox/utilities/preview_builders.py