Check for absolute paths in server URL before passing to find

Various double slashes and URL encodings can bypass current checks.
In the case of the file existing, the server will 500 instead of 403
which leaks the existence but not the contents of the file.

Props to @eadz for finding this.
Add security note to changelog
Sprockets 2.12.3