curl: arbitrary file read via `file://` path traversal with `–path-as-is`