0.2.41: contain SPA static serving to the web root

Percent-encoded traversal (..%2f) survived routing and let an
unauthenticated request read files outside static/, including the
database and session secret on the data volume. Paths are now resolved
and contained to the frontend build directory; anything that escapes
falls back to index.html.

deploy/startos/install/versions/v_0_2_41.ts

@@ -0,0 +1,17 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_41 = VersionInfo.of({
+  version: '0.2.41:0',
+  releaseNotes: {
+    en_US:
+      'Security fix: closes an unauthenticated path-traversal flaw in the ' +
+      'static file server that let a crafted URL read files outside the web ' +
+      'root (including the database and session secret). Requests are now ' +
+      'contained to the frontend build directory. Upgrade recommended for all ' +
+      'internet-facing deployments.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})