Fixed twig filesystemloader security issue + test

Would allow to go up a maximum of one directory