Authenticated plugin path traversal via raw identifier

Path traversal in the MineAdmin app-store plugin service before 3.2.0-alpha.2 lets remote authenticated users reach paths outside the plugin tree. Its download, install, and uninstall methods append an unvalidated identifier to plugin paths and pass it to plugin operations. An account with an access token can probe directory existence or invoke plugin operations outside the intended tree; Composer execution depends on the targeted directory.