check_resource_allowed(): path matching skips dot-segment/percent-encoding normalization (auth-boundary bypass)

check_resource_allowed(): path matching skips dot-segment/percent-encoding normalization (auth-boundary bypass) #6450