Containment, not string matching

1. static boolean contained(java.nio.file.Path root, String userPath) — resolve userPath against root, NORMALIZE, and return whether the result is still inside root (startsWith on normalized paths). Must reject "../../etc/passwd" but accept "docs/report.txt" and even "docs/../docs/report.txt" (it normalizes INSIDE). 2. static boolean allowsHost(String host, java.util.Set<String> allowlist) — exact-match membership (no substring tricks); lowercase both sides. 3. static String classifyUrl(String url, java.util.Set<String> allowlist) — parse the host out of http://HOST/... (between "://" and the next "/"), return "allowed" if the host is in the allowlist else "blocked". Malformed (no ://) → "blocked".

Difficulty: advanced