Sensitive file inclusion via Unicode ignore bypass

Information disclosure in HashiCorp go-slug 0.4.0 through 0.18.2 allows local attackers to include excluded files in Terraform slug uploads. .terraformignore rule evaluation compared raw pattern and path strings that can be canonically equivalent but byte-distinct; on affected macOS filesystems, NFD filenames could evade NFC ignore rules and still be packaged. Exploitation requires control of a local working directory whose filenames and ignore patterns differ only by Unicode normalization, and the consequence is unintended disclosure of files uploaded to remote Terraform runs.