fix: reject path separators in get_static_doc names

[farkhalit]

get_static_doc joins {serviceName}.{version}.json onto DISCOVERY_DOC_DIR without checking where the result lands, so with static discovery (the default for build()) a name such as ../../../../tmp/evil, an absolute path, or a UNC path on Windows loads a discovery document from outside the bundled set. That document supplies rootUrl, so the returned client sends its developer key and credentials to whatever host the file names; the HTTP discovery path is not affected because uritemplate percent-encodes the same values. Names that are not a bare file name are now treated as unknown, which surfaces as the existing UnknownApiNameOrVersion.

• Make sure to open an issue as a bug/issue before writing your code! That way we can discuss the change, evaluate designs, and agree on the general idea
• Ensure the tests and linter pass
• Code coverage does not decrease (if any source code was changed)
• Appropriate docs were updated (if necessary)

[gemini-code-assist]

Code Review

This pull request adds a path traversal check to get_static_doc to prevent reading discovery documents outside of the designated directory, and includes a test case to verify this behavior. The review feedback points out that using os.path.basename is platform-dependent and suggests explicitly checking for both forward and backward slashes to ensure robust protection across all operating systems, along with adding a corresponding test case with backslashes.

[gemini-code-assist]

Using os.path.basename to detect path separators is platform-dependent. On Unix-like systems, os.path.basename does not recognize backslashes (\) as directory separators, whereas on Windows it does. To ensure robust, platform-independent protection against directory traversal attacks, we should explicitly reject both forward slashes (/) and backslashes (\) in the document name, regardless of the operating system the code is running on.

Suggested change

	if os.path.basename(doc_name) != doc_name:
	return content
	if "/" in doc_name or "\\" in doc_name or os.path.basename(doc_name) != doc_name:
	return content

[gemini-code-assist]

To ensure that the platform-independent path traversal protection works correctly across all environments, we should explicitly test a path containing backslashes (\) even when running on Unix-like systems.

Suggested change

	for name in (outside, os.path.relpath(outside, DISCOVERY_DOC_DIR)):
	for name in (outside, os.path.relpath(outside, DISCOVERY_DOC_DIR), "..\\..\\zoo"):