[rootsiemen]

Closes #905

Problem

StaticFilesMiddleware used the raw request path, and Workerman Request::path() does not decode percent-encoding. A file like hello world.txt requested as /hello%20world.txt (or a UTF-8 name like za%C5%BC%C3%B3%C5%82%C4%87.txt) was looked up with %20 in the name, missed, and fell through to Symfony with a 404.

Fix

• __invoke() now calls rawurldecode() on the path exactly once and passes the decoded path to both isAllowlistExtensionMismatch() and getPublicPathFile() (which now takes the path string instead of the request).
• The NUL, backslash and root guards in getPublicPathFile() run on the decoded path, and realpath() plus the root-prefix check stay as the last guard.
• Decoding is deliberately single: %252e%252e decodes once to the literal name %2e%2e, never to ... rawurldecode() (not urldecode()) is used so + is not turned into a space.

Tests

• testPercentEncodedSpaceAndUtf8NamesAreServed: /hello%20world.txt and a percent-encoded UTF-8 name are served with 200. The UTF-8 name is built from its percent-encoded form so the test file stays ASCII-only.
• testEncodedTraversalAndDoubleEncodingPassToNext (data provider): %2e%2e/, %00, %252e%252e and %5C..%5C paths all fall through to $next instead of being served.

Note: this environment has no PHP runtime, so the PHPUnit suite could not be run here — the change is small, follows the issue's fix idea exactly, and CI's test job is the verification step. Please let me know if CI flags anything.