fix(auth): normalize resource path dot-segments - #3308

Summary

• Resolve raw and percent-encoded dot-segments before checking resource hierarchy.
• Preserve repeated path separators and encoded separators such as %2F.
• Add regression tests for traversal and encoding cases.

Fixes #3303

Why

check_resource_allowed() previously used a direct startswith() comparison after only trailing-slash normalization. A requested resource such as /api/../admin could therefore pass a check configured for /api, even though it resolves outside the configured resource.

The implementation decodes only encoded dots (%2e), rather than fully unquoting the path. It then applies RFC-style dot-segment removal without collapsing empty path segments, so repeated separators remain significant. This avoids both path traversal and accidental widening of a resource boundary such as /api//.

Validation

• pytest tests/shared/test_auth_utils.py -q — 19 passed
• Full test suite — 5584 passed, 10 skipped, 1 xfailed
• Coverage — 100.00%
• Ruff check and format — passed
• Pyright — passed
• strict-no-cover — passed

AI assistance was used during investigation and implementation; I reviewed the resulting code and tests myself.