Clean up Makefile, tests and legacy code (#36638)

This simplifies the Makefile by removing the whole-file wrapping that
creates a tempdir introduced by
https://github.com/go-gitea/gitea/pull/11126. REPO_TEST_DIR is removed
as well.

Also clean up a lot of legacy code: unnecessary XSS test, incorrect test
env init, unused "_old_uid" hack, etc

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

models/unittest/fscopy.go

@@ -4,10 +4,12 @@
 package unittest
 
 import (
+	"errors"
 	"os"
 	"path/filepath"
 	"strings"
 
+	"code.gitea.io/gitea/modules/setting"
 	"code.gitea.io/gitea/modules/util"
 )
 
@@ -39,7 +41,20 @@ func SyncFile(srcPath, destPath string) error {
 // SyncDirs synchronizes files recursively from source to target directory.
 // It returns error when error occurs in underlying functions.
 func SyncDirs(srcPath, destPath string) error {
-	err := os.MkdirAll(destPath, os.ModePerm)
+	destPath = filepath.Clean(destPath)
+	destPathAbs, err := filepath.Abs(destPath)
+	if err != nil {
+		return err
+	}
+	devDataPathAbs, err := filepath.Abs(filepath.Join(setting.GetGiteaTestSourceRoot(), "data"))
+	if err != nil {
+		return err
+	}
+	if strings.HasPrefix(destPathAbs+string(filepath.Separator), devDataPathAbs+string(filepath.Separator)) {
+		return errors.New("destination path should not be inside Gitea data directory, otherwise your data for dev mode will be removed")
+	}
+
+	err = os.MkdirAll(destPath, os.ModePerm)
 	if err != nil {
 		return err
 	}