Add path traversal attack tests

[kele]

https://owasp.org/www-community/attacks/Path_Traversal

Check the behavior of the Go's standard library file server functions, like:

• http.FileServer
• http.ServeFile

[empijei]

I would also add that the Filename field of the multipart FileHeader type might be a relative directory path or a fully qualified path unlike the name seems to suggest.

This means that users might inadvertently allow attackers to upload file outside of their intended directory if no path stripping is performed.

To summarize we have to protect against two kinds of path traversal attacks: on file submission and on resource requests (AKA, path traversal in upload/download).