Fix path traversal in browser delete via MPD path - #661

Browser::remove joined the raw MPD-supplied item path with mpd_music_dir
via realPath without filtering '..' segments, then called fs::remove. A
remote or compromised MPD server presenting a directory or song whose
path contains '..' could cause deletion of an arbitrary user-owned file
or directory outside mpd_music_dir when the user pressed delete in the
MPD browser. The confirmation prompt displays only the basename, so the
traversal was hidden from the user.

Add a local normalizePath helper in the anonymous namespace that
collapses '.' and '..' segments (relative paths cannot escape above
their root, absolute paths keep their leading slash) and apply it to the
MPD-supplied path inside realPath before joining with mpd_music_dir.
Legitimate relative paths are unchanged; only traversal segments are
removed.