Block symlink dir traversal for /static

This is in line with how it behaved before, but it was lifted a little for the project mount for Hugo Modules,
but that could create hard-to-detect loops.

hugolib/hugo_sites_build_test.go

@@ -2,7 +2,6 @@ package hugolib
 
 import (
 	"fmt"
-	"os"
 	"strings"
 	"testing"
 
@@ -1282,7 +1281,7 @@ func readFileFromFs(t testing.TB, fs afero.Fs, filename string) string {
 			root = helpers.FilePathSeparator + root
 		}
 
-		helpers.PrintFs(fs, root, os.Stdout)
+		//helpers.PrintFs(fs, root, os.Stdout)
 		t.Fatalf("Failed to read file: %s", err)
 	}
 	return string(b)