GHSA-qrqq-9c63-xfrg tower-http's improper validation of Windows paths could lead to directory traversal attack

• crates.io tower-http: >= 0.2.0, < 0.2.1 → fixed in 0.2.1 • crates.io tower-http: < 0.1.3 → fixed in 0.1.3

`tower_http::services::fs::ServeDir` didn't correctly validate Windows paths, meaning paths like `/foo/bar/c:/windows/web/screen/img101.png` would be allowed and respond with the contents of `c:/windows/web/screen/img101.png`. Thus users could potentially read files anywhere on the filesystem. This only impacts Windows. Linux and other unix likes are not impacted by this. See [tower-http#204] for more details. [tower-http#204]: https://github.com/tower-rs/tower-http/pull/204