Normalize request paths at the application boundary.

[samuel-williams-shopify]

Summary

• Represent request URLs with the structured path interface released in protocol-url v0.11.
• Normalize untrusted external paths once at request construction, including simplifying dot segments, repeated separators, and parent traversal above the root.
• Reject malformed encoding, relative request paths, fragments, control characters, and ambiguous backslashes.
• Preserve encoded segment boundaries through controller, content, localization, redirection, and static middleware.
• Resolve filesystem-backed paths with Protocol::URL::Path#local_path and retain component boundaries in lookup caches.
• Keep trusted internal URL rewrites unsimplified.
• Restore the separate Rewrite, DirectoryIndex, and Moved redirection middleware while retaining the separate Errors implementation.

Testing

• 150 focused application tests passed (346 assertions).
• 122 path, controller, content, and static regression tests passed (331 assertions).
• RuboCop passed for all 25 changed Ruby files.
• Documentation coverage passed: 483/483 public definitions.
• The full suite reached 333 passing tests; four generated-project command tests were blocked by stale native extensions in the local vendor/bundle.