Why block nginx requests with a pair of periods (..) in the query?

See https://github.com/aegir-project/provision/blob/7.x-3.x/http/Provision/C...
Aegir's nginx config is blocking requests containing .. in the query string and I'm trying to figure out why. The comment says "for security reasons" but doesn't say what this actually mitigates.

I need to allow requests with this string in order to use Google's OpenID Connect implementation. The oauth redirect request from Google contains a session_state query parameter with .. in it.

If we can find out what this is trying to mitigate I can hopefully rewrite the regexp to be more specific rather than removing that check completely.