Block symlink dir traversal for /static

This is in line with how it behaved before, but it was lifted a little for the project mount for Hugo Modules,
but that could create hard-to-detect loops.

tpl/data/resources_test.go

@@ -203,7 +203,7 @@ func newDeps(cfg config.Provider) *deps.Deps {
 	fs := hugofs.NewMem(cfg)
 	logger := loggers.NewErrorLogger()
 
-	p, err := helpers.NewPathSpec(fs, cfg)
+	p, err := helpers.NewPathSpec(fs, cfg, nil)
 	if err != nil {
 		panic(err)
 	}