fix: prevent path traversal through hashed asset routes

[tdurieux]

Unauthenticated requests to the hashed asset routes could read files outside public/ through raw or URL-encoded traversal paths. Validate decoded filename components and check that the resolved path stays inside the selected asset directory before serving it. Invalid paths return 404; valid assets retain immutable caching.

Regression tests execute the production route with temporary files and cover both asset directories, encoded traversal, sibling-directory escapes, valid assets, missing assets, and static fallback. Before the fix, 10 traversal cases returned 200 instead of 404.

Validation:

• 20 focused route and asset-build tests pass; targeted ESLint and diff checks pass.
• Full suite: 655 passing, 49 pending, 6 failures in runtime regression and legacy Vue hashbang tests outside this change.
• TypeScript checking reports errors in unchanged anonymize-utils, GitHubDownload, and webview files.