caddyhttp: fix url_pattern authorization bypass via encoded-slash traversal (#7941)