Recursive COPY, MOVE, DELETE and PROPFIND were checked only against the
requested path, reaching descendants their rules deny. A broad rule shadowed
a narrower one naming a collection. LOCK was allowed on any permission, so a
read-only user could create files and block writers. Rules compared case
where the backing file system does not.
* fix: resolve dot segments before checking path rules (GHSA-chxv-mvjv-f92j)
* fix: match trailing-slash path rules against the bare collection
* fix: match destination rules against the URL path when no prefix is set
* fix: restrict collections named by a rule without granting access to them
* docs: cleanup
Directory makes it more clear of what it is. In addition, this will make it easier when
allowing for multiple directories in the future, since we can just name it 'directories', which is more clear than 'scopes'.
Henrique Dias