Block symlink dir traversal for /static

This is in line with how it behaved before, but it was lifted a little for the project mount for Hugo Modules,
but that could create hard-to-detect loops.

source/filesystem_test.go

@@ -103,7 +103,7 @@ func newTestConfig() *viper.Viper {
 func newTestSourceSpec() *SourceSpec {
 	v := newTestConfig()
 	fs := hugofs.NewFrom(hugofs.NewBaseFileDecorator(afero.NewMemMapFs()), v)
-	ps, err := helpers.NewPathSpec(fs, v)
+	ps, err := helpers.NewPathSpec(fs, v, nil)
 	if err != nil {
 		panic(err)
 	}