Function resolve_safe_path 

pub fn resolve_safe_path(out_dir: &Path, remainder: &str) -> Option<PathBuf>

Resolve a URL path remainder (already base-stripped) to a filesystem path inside out_dir. Returns None for any input that would escape out_dir or that contains components forbidden for security reasons.

Rules:

• Percent-decode each segment.
• Reject any segment equal to .., ., empty (consecutive //), or containing \ / NUL.
• Reject Windows drive prefixes / absolute markers in any segment.
• If the original path ends with / or is empty, append index.html.