Reject traversal segments when constructing raw content URLs

[SamMorrowDrums]

Describe the bug

Raw repository-content URLs are assembled with url.URL.JoinPath. Because JoinPath normalizes dot segments, a path containing a .. segment can change the owner, repository, or ref represented by the resulting URL. Authorization remains enforced by GitHub, but the fetched content can differ from the resource URI returned to the client.

Affected version

Current main as of 2026-08-19.

Steps to reproduce the behavior

1. Construct a raw-content request whose content path contains parent-directory segments.
2. Observe the URL produced by the raw client.
3. See that normalization can consume the owner, repository, or ref path segments.

Expected vs actual behavior

Expected: repository content paths cannot alter the owner, repository, or ref used to construct the outbound request.

Actual: path normalization can rebind those components before the request is sent.

Logs

N/A