Fix path traversal vulnerability

[lo-simon]

A path traversal vulnerability has been identified in the Registry Admin UI in Windows. The vulnerability exists in make_filesystem_route, where the code sanitises user-controlled file paths by checking for forward-slash parent directory sequences (/..) but completely ignores the backslash variant (..), which is a valid path separator on Windows systems.

How the fix works:

1. Normalise path separators to forward slashes
   • /foo/./bar\..\baz -> /foo/./bar/../baz
2. Split the path by/into segments
   • /foo/./bar/../baz -> ["foo", ".", "bar", "..", "baz"]
3. Processes each segment:
   • . (current directory) -> Skip it
   • .. (parent directory) -> Pop the last segment from the stack
   • Normal segment -> Add to stack
4. Detects traversal attacks:
   • If .. tries to pop from an empty stack -> Returns false (attempting to escape root)
5. Reconstructs the normalised path:
   • ["foo", "baz"] -> /foo/baz

Examples:

Input	Normalised Output	Result
/foo/./bar	/foo/bar	✅ Allowed
/foo/../bar	/bar	✅ Allowed
/foo/bar/../../baz	/baz	✅ Allowed
/../secret	N/A	❌ Forbidden (traversing above root)
/foo/../../etc/passwd	N/A	❌ Forbidden (traversing above root)
/../	N/A	❌ Forbidden (traversing above root)

[garethsb]

Seems excessive. Previously we just banned any use of "/..". If the problem is Windows, a tiny tweak to that would be enough.