fix: handle Windows backslash separators in isPathWithinRoot (#187)

On Windows, path.join() / path.resolve() produce paths with backslash
separators. isPathWithinRoot() hardcoded '/' in its startsWith check,
causing every stat/read/write on OverlayFs to ENOENT on Windows.

- Accept both '/' and '\' as valid separators after the root prefix
- Normalize backslash to '/' in sanitizeSymlinkTarget relativePath
- Add Windows backslash test cases for isPathWithinRoot