Follow-up from "Use the Dependency Proxy with private GitLab projects"

The following discussion from !46042 (merged) should be addressed:

• @vdesousa started a discussion:

  @sabrams we should add a path_traversal check here (I know it's not introduced with this MR, but maybe we can do that in a follow-up)