Reject dot-segment traversal paths

[kingpy-bot]

Summary

• reject . and .. path segments before Passage creates the upstream request
• apply the check after percent-decoding stabilizes, so encoded separators and nested encodings cannot hide a traversal segment
• keep ordinary dotted names such as v1.2, .well-known, and file..name working unchanged

Invalid paths now receive a JSON 400 response before handler construction, request transformation, caching, or upstream HTTP.

Tests

• focused regression: 6 traversal variants / 24 assertions passed (the suite failed on all 6 before the guard)
• vendor/bin/pest: 109 tests / 283 assertions passed
• vendor/bin/pint --test src/Http/Controllers/PassageController.php tests/Unit/PassageControllerTest.php: passed
• git diff --check: passed

Closes #96.