GHSA-qrp7-cvwr-j2c6: Caddy: Windows `file_server` path authorization bypass via encoded backslash

On Windows, Caddy has a security vulnerability where attackers can bypass path-based authorization rules by using encoded backslashes (URL-encoded as %5c) in requests. The issue occurs because Caddy's path matcher doesn't treat backslashes as path separators when checking authorization rules, but the file server does when accessing files on disk, allowing an attacker to request `/private%5csecret.txt` and bypass protections meant to block `/private/*` access.