Fix path traversal via symlink in embedded_get()

[AAtomical]

os.path.abspath() is purely lexical and does not resolve symbolic links. A crafted PDF with an embedded filename like "link/pwned.txt", where "link" is a symlink pointing outside cwd, passes the abspath guard but open() follows the symlink at write time.

Replace abspath() with realpath() so the containment check resolves the full symlink chain before comparing against the working directory.
fix #5089

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}

[AAtomical]

I have read the CLA Document and I hereby sign the CLA