fix: close static file allowlist bypass (closes #580)

[s2x]

Description

Closes #580

Changes

• Block extensionless files when StaticFilesMiddleware uses allowed_extensions.
• Keep the denylist authoritative even when a blocked extension is listed.
• Check blocked path components correctly when filesystem paths use backslashes.
• Add regression coverage for extensionless files, trailing-dot names, nested .htaccess, Windows separators, and indistinguishable 404 responses.
• Update static-file security documentation and the unreleased changelog.

Code Review

• Local security/diff review completed
• All review findings addressed
• Full lint passed
• Full test suite passed

Test results

• composer lint — passed
• composer test — passed: 1576 tests, 13360 assertions, 18 skipped, 1 pre-existing warning
• Targeted StaticFilesMiddlewareTest — passed: 61 tests, 108 assertions