Refuse a file directory that leaves the files folder

Problem/Motivation

The settings form accepts ../x as File directory. validateDirectory() only trims slashes, so files would be written to public://../x.

Steps to reproduce

1. Set File directory to ../x on the settings form.
2. Save. It is accepted.

Proposed resolution

Refuse . and .. segments and absolute paths with a field error.

Remaining tasks

• ✅ File an issue
• ❌ Addition/Change/Update/Fix
• ❌ Testing to ensure no regression
• ➖ Automated unit/functional testing coverage
• ➖ Developer Documentation support
• ➖ User Guide Documentation support
• ➖ UX/UI designer responsibilities
• ➖ Accessibility and Readability
• ❌ Reviewed by a human
• ❌ Code review by maintainers
• ❌ Full testing and approval
• ❌ Credit contributors
• ❌ Review with the product owner
• ✅ Update Release Notes
• ✅ Release

User interface changes

• Before (1.0.x): a file directory of ../x is saved.
  
• After: ../x is refused with a field error.
  

API changes

• N/A

Data model changes

• N/A

Release notes snippet

• N/A

AI-Generated: Yes