fix: allow fs.deny matching for entire path

[jtmcdole]

Description

server.fs.deny should match and deny the path

fixes GHSA-8jhw-289h-jh2g

Additional context

---

What is the purpose of this pull request?

• Bug fix
• New Feature
• Documentation update
• Other

Before submitting the PR, please make sure you do the following

• Read the Contributing Guidelines, especially the Pull Request Guidelines.
• Check that there isn't already a PR that solves the problem the same way to avoid creating a duplicate.
• Provide a description in this PR that addresses what the PR is solving, or reference the issue that it solves (e.g. fixes #123).
• Update the corresponding documentation if needed.
• Ideally, include relevant tests that fail without this PR but pass with it.

[stackblitz]

Run & review this pull request in StackBlitz Codeflow.

[jtmcdole]

I've not had time to look at the tests or the structure.

[sapphi-red]

Closing as this is fixed by #16250