Function resolve_document_path 

pub fn resolve_document_path(
    uri: &str,
    workspace_root: &Path,
) -> Result<PathBuf, String>

Resolve a document URI and ensure it lies under workspace_root (both canonical).