Fix a directory traversal vulunerability of Clack.Middleware.Static.

ref. https://github.com/fukamachi/caveman/issues/36

Thank @geomaster for reporting this.
Fix tests.