GHSA-7p7c-pvvx-2vx3: hyper-staticfile's improper validation of Windows paths could lead to directory traversal attack

The vulnerability stems from how normalize_path handled path components. The original implementation (pre-patch) directly pushed 'Component::Normal' segments without validating if they contained Windows drive letter prefixes. The patch adds a secondary check that re-parses each component to ensure it doesn't contain drive letters or other special components. This matches the vulnerability description where paths like '/foo/bar/c:/windows/...' would resolve to absolute Windows paths. The added Windows-specific test in static.rs confirms this was the attack vector.