SECURITY: Fix path traversal in script verification

The following used to be allowed:

   scripts: https://static.rc3.world/scripts/../maps/81c8add623eea2704f20/e65b545e-342f-4be0-b369-c0eacff7b15d/re-blessed.mp3.js

This is obviously not good, as it allows scripts from arbitrary maps.