Fix GeoServerResourceLoader when $PWD is /

When $PWD is / for the process running GeoServer, GeoServerResourceLoader can "find" files and directories outside GEOSERVER_DATA_DIR. For instance, our VM images include a /security directory. GeoServer interprets this as its own "security" directory and tries to read from/write to it, which fails. This pull request just refuses to look outside the search path unless a parent directory is also specified, in which case looking in $PWD might be intentional, as it is during unit tests.