Potential fix for code scanning alert no. 2: Uncontrolled data used in path expression

[ohgodwhy2k]

Potential fix for https://github.com/ohgodwhy2k/quicksite/security/code-scanning/2

To fix the issue, we should prevent path traversal by making sure all file access is constrained to the DIST_ROOT directory. The steps are:

1. Normalize the requested path so that directory traversal like .. is resolved.
2. Use an absolute root (DIST_ROOT) and ensure the resolved path is always within it, by checking that the final, normalized resolved path starts with (or equals) the absolute root.
3. Only after passing this check, read and serve the file.

Implement these changes in scripts/serve.js, by:

• Importing resolve from node:path.
• Resolving both DIST_ROOT and the requested user path to their absolute versions using path.resolve().
• After resolution, check that the requested file's path starts with the root directory. If not, return a 403 Forbidden error.

No other functionality should change; file serving and MIME type detection remain as in the original.

---

Suggested fixes powered by Copilot Autofix. Review carefully before merging.