[PR] Prevent path traversal in static file routes (#912)

[lackas]

Related Issue

Fixes #912.

Proposed Changes

static_route and static_route_exts interpolate the {fname:path} URL segment straight into FileResponse(f'{static_path}/{fname}…'). The path converter matches .., so /%2e%2e/secret.md resolves outside static_path and serves any file the worker process can read.

New helper _static_fpath resolves the request against static_path and raises HTTPException(404) if it escapes; both handlers route through it. The containment check is the one Starlette's own StaticFiles.lookup_path uses (realpath + commonpath), so a symlink inside static_path pointing outside it is also rejected.

Nested paths and an explicit static_path above the app dir (e.g. static_path='../..', as in the existing tests) are unaffected. Only .. within the request path is rejected.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist

• My code follows the code style of this project.
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have added tests to cover my changes.
• All new and existing tests passed (nbdev_test --path nbs/api/00_core.ipynb). Both new assertions fail on unpatched main.
• I am aware that this is an nbdev project, and I have edited, cleaned, and synced the source notebooks instead of editing .py or .md files directly.