Improve path traversal protection

Adds protections against absolute paths and ".." directory traversal. Enforces the relative paths are well-formed with no extra path separators.

Closes #2299 and #2419.