Fuzz the path validators and the Markdown sanitizer

Fuzz the path validators and the Markdown sanitizer

Two pieces of untrusted text decide where a file is written and what a browser
runs: the validators that turn a request path, an artifact glob, or a site
directory into a place under a root, and the markdown boundary where goldmark and
bluemonday turn a pushed body into HTML a page trusts.

The sanitizer assertions parse the output with an HTML parser rather than
searching the string, because the difference is the whole question: a script tag
rendered as text is a text node, and hand-written <script> looks the same to a
substring search. The test asks what the browser will do: no script-shaped
element, no on* attribute, and no scheme outside http, https, mailto.

The path targets state the guarantee the way the caller uses it -- joined to a
root, the result stays under that root -- and pin that cleaning is idempotent, so
one page cannot become two cache keys.

cleanPath's comment claimed dot segments were refused; they are resolved, and the
comment now says so, which is what the property pins.

Closes #98.