fix: critical path traversal vulnerability in WebDAV proxy endpoint

- Sanitize path components to prevent directory traversal attacks
- Filter out '.', '..', and empty path components
- URL encode path components to prevent injection attacks
- Prevents potential SSRF attacks via path manipulation

This vulnerability could allow attackers to:
- Access unintended resources outside the WebDAV scope
- Potentially reach internal services or metadata endpoints
- Bypass access controls through path manipulation

Security impact: HIGH - Path traversal is a critical security issue

app/api/webdav/[...path]/route.ts

@@ -62,7 +62,12 @@ async function handle(
     endpoint += "/";
   }
 
-  const endpointPath = params.path.join("/");
+  // Sanitize path components to prevent path traversal attacks
+  const sanitizedPathComponents = params.path
+    .filter(component => component && component !== '.' && component !== '..')
+    .map(component => encodeURIComponent(component));
+  
+  const endpointPath = sanitizedPathComponents.join("/");
   const targetPath = `${endpoint}${endpointPath}`;
 
   // only allow MKCOL, GET, PUT