Reject percent-encoded dot segments in ModuleScript.isSandboxed

[naaz234]

while reading the commonjs loader i noticed that ModuleScript.isSandboxed decides containment with URI.relativize, which only normalises literal dot segments on the raw path, while the file: url handler percent-decodes the path again before it opens the file. so with a sandboxed require rooted at file:///app/modules/, an id like %2e%2e/secret or ..%2Fsecret passes the check but loads and runs /app/secret.js and hands its exports back to the script, whereas ../secret and absolute ids are rejected as expected. the gate seems to be the right layer for this since the source providers don't know whether they are serving a sandboxed require, so this makes it look at the decoded relative path too and refuse any .. segment (on either separator, for windows). the check still runs after the source has been compiled, as it already does for absolute ids, and i've left that ordering alone. added a case to RequireTest for the three encoded spellings, which fails on master and passes here.