fix: preserve UNC path prefix in isPathWithinAllowedDirectories

[hashwnath]

Summary

Fixes #3756

On Windows, isPathWithinAllowedDirectories fails for UNC paths (e.g. \\server\share\project) because path.resolve(path.normalize(...)) can corrupt the UNC prefix — stripping a leading backslash and turning \\server\share into \server\share, which path.resolve then interprets as drive-relative (e.g. C:\server\share). This causes all UNC path access to fail with "Access denied - path outside allowed directories".

Fix

Extract path normalization into a normalizePath() helper that detects UNC paths and normalizes them without path.resolve:

• UNC paths (\\server\share\...) are always absolute, so path.normalize alone is sufficient
• After normalization, verify the \\ prefix is preserved; restore it if stripped
• Non-UNC paths continue using path.resolve(path.normalize(...)) as before

Test plan

• All 53 existing path-validation tests pass
• On Windows with a UNC allowed directory (\\192.168.x.x\share), files within the share are now accessible
• Non-UNC paths (drive letters, Unix paths) behave identically to before