Add ....//, ....\\, and URL-encoded variants to cover filter normalization bypasses where ../ is stripped but ....// resolves to a parent directory traversal. Co-authored-by: Cursor <cursoragent@cursor.com>
