REPRO-2026-00299: Horilla protected_media public-prefix normalization bypass: unauthenticated private in-root read on the repaired release

Horilla's protected_media() view makes the authorization decision using path.startswith() on the RAW request path, while the filesystem decision uses safe_join(settings.MEDIA_ROOT, path) on the CANONICAL path. When an attacker requests /../../, the raw path passes the allowlist prefix check (authorization granted), but the filesystem normalizes the dot segments and serves a private in-root media file. The resolved file never leaves MEDIA_ROOT, so safe_join() is satisfied. This is NOT path traversal.