fix(raw): reject traversal segments when constructing raw content URLs

url.URL.JoinPath normalizes ".." segments before producing the final
URL. A path containing enough parent-directory segments could
therefore consume the owner, repo, and ref components already joined
onto the base URL, rebinding the raw.githubusercontent.com request to
a different owner/repository/ref than the caller specified.

Reject any owner, repo, ref/sha, or path component whose "/"-separated
segments are, or percent-decode to, ".." before building the URL.
Benign filenames such as "file..txt" or "..hidden" are unaffected.

URLFromOpts, refURL, and commitURL now return an error alongside the
URL string so this can be enforced at construction time; GetRawContent
propagates it. Adds table-driven tests covering normal, nested, and
benign double-dot paths as well as literal and percent-encoded
traversal attempts.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>