Fix scope path boundary validation to deny sibling-prefix authorization bypasses Reject parent-directory traversal in scope paths, including encoded traversal forms Add regression tests covering sibling-prefix and traversal authorization checks

Source: Fedora 44 SciTokens-CPP Critical Path Validation Fix 2026-176625c3fc