check normalize() restricts access to root parent dirs

add 3 tests that check the path used for combo urls like:

1. undefined: /combo?/public/../../README.md
2. resolved relative to docroot: /combo?/public/../fixtures/robot.txt
3. resolved relative to docroot: /combo?/public//\/etc/passwd