By: Michael Lynch <git@mtlynch.io>
Reject unsafe media paths Reject absolute paths, current-directory subfolders, and parent-directory traversal in media path values so generated media paths stay within the expected backend-relative root.