CVE-2019-18978: The rack-cors rubygem may allow directory traveral

The vulnerability stems from improper path normalization before resource matching. The commit e4d4fc3 introduced a new evaluate_path function to unescape and resolve paths, then passed this sanitized path to process_preflight, process_cors, and match_resource. Prior to this fix, these functions used the raw env[PATH_INFO] value, which could contain unescaped '../' sequences. The lack of canonicalization in match_resource (which performed the actual resource matching) allowed attackers to bypass access controls. The high confidence comes from the explicit patch changes showing these functions were modified to accept sanitized paths, and test cases added to verify path traversal prevention.