Block symlink dir traversal for /static

This is in line with how it behaved before, but it was lifted a little for the project mount for Hugo Modules,
but that could create hard-to-detect loops.

hugofs/fileinfo.go

@@ -180,9 +180,20 @@ type FileMetaInfo interface {
 
 type fileInfoMeta struct {
 	os.FileInfo
+
 	m FileMeta
 }
 
+// Name returns the file's name. Note that we follow symlinks,
+// if supported by the file system, and the Name given here will be the
+// name of the symlink, which is what Hugo needs in all situations.
+func (fi *fileInfoMeta) Name() string {
+	if name := fi.m.Name(); name != "" {
+		return name
+	}
+	return fi.FileInfo.Name()
+}
+
 func (fi *fileInfoMeta) Meta() FileMeta {
 	return fi.m
 }
@@ -295,3 +306,11 @@ func normalizeFilename(filename string) string {
 	}
 	return filename
 }
+
+func fileInfosToNames(fis []os.FileInfo) []string {
+	names := make([]string, len(fis))
+	for i, d := range fis {
+		names[i] = d.Name()
+	}
+	return names
+}