fix: correctly detect if a path is inside the project root or not

[jfly]

We had a handful of bugs here:

1. It's not enough to check if a relative path starts with .., as it's valid for files to literally start with 2 dots. You need to check for the path separator as well.
2. Stdin mode incorrectly assumed that any paths that start with .. are outside of the tree root. This is wrong in 2 ways: - If we're in a subdirectory of the project, ../foo is still very much inside the project. - Path's can still escape without starting with ../. For example: foo/../../bar escapes the project root.
3. Stdin mode incorrectly treated relative paths given by the user as relative to the project root. Now they are correctly treated as relative the current directory, and massaged into paths that are relative to the project root. The simplest approach to fixing this was to DRY up the path processing logic between stdin/non stdin mode.

This fixes #700