Sapphire Livingstone

ocaml-cohttp stops percent-encoded ..%2f from escaping the docroot

The fix decodes a request path exactly once before removing dot segments, so ..%2f..%2f no longer resolves outside the docroot. Servers that gate access on path prefixes still have to call the new Cohttp.Path.normalise themselves.