Add test to prove a path traversal attack

If I try to retrieve the translations using the following url:

    http://localhost/translations?locales=randomstring/something

The file `something.js` gets created in the subdirectory
`messages.randomstring` of the cache directory:

    /var/www/someproject/app/cache/dev/bazinga-js-translation/messages.randomstring/something.js

This is the actual string that gets passed to the constructor of
`ConfigCache` by the JsTranslationBundle controller.

I can now traverse down from the JsTranslationBundle cache directory
(without first creating the `messages.randomstring` directory using the
previous step, this won't work):

    http://localhost/translations?locales=randomstring/../../evil

becomes:

    /var/www/someproject/app/cache/dev/bazinga-js-translation/messages.randomstring/../../evil.js

... and depending on the configuration of the server, I could also do:

    http://localhost/translations?locales=randomstring/../../../../../web/evil

=>

    /var/www/someproject/app/cache/dev/bazinga-js-translation/messages.randomstring/../../../../../web/evil.js

Thus creating the file `evil.js` (and `evil.js.meta`) under the Symfony
`web` root. Depending on file system permissions, this will also
overwrite existing files.

Signed-off-by: William DURAND <william.durand1@gmail.com>
Fix potential code injection via `locale` parameter

Depending on the server configuration, it seems to be possible to inject
actual JavaScript code:

    http://localhost/translations?locales=foo%0Auncommented%20code;

=>

    (function (Translator) {
        Translator.fallback      = 'en';
        Translator.defaultDomain = 'messages';
        // foo
    uncommented code;
    })(Translator);

This issue has been reported by Andreas Forsblom.

This fix filters given locales and remove all locales that are not known
by the Locale (intl extension) class.

Signed-off-by: William DURAND <william.durand1@gmail.com>
Change test related to path traversal attack

so that it shows that the fix works

Signed-off-by: William DURAND <william.durand1@gmail.com>