Make path separator replacements a configuration option

This allows descending in to subdirectories while using the filesystem source.

Note that while the commit author is convinced that Clean() before Join() is
sufficiently safe, there are other aspects which may give an attacker access
to images outside of the configured source directory, i.e. a symbolic link.
Defaulting this option to false for further scrutiny.