Canonicalizing Path Sandboxer

Implement sandboxPath: split on '/', process segments against a stack, then require the canonical result to be under "/data". The battery includes escapes that contain no literal ".." pattern naively banned, and stays-legal paths that contain ".." legitimately.

Difficulty: advanced