REPRO-2026-00298: Horilla protected_media composed chain: unauthenticated outside-root file read, with necessity controls for each component defect

Horilla HR protected_media() view has two independently necessary defects that compose into an unauthenticated arbitrary file read: (1) path traversal via unsanitized os.path.join(MEDIA_ROOT, path) and (2) Referer-based authorization bypass. A single HTTP request with no cookie/session/JWT/bearer, carrying a spoofed Referer header pointing to /login, bypasses auth and escapes MEDIA_ROOT to read any file readable by the Horilla process.