fix(npm): normalize path in BYONM read permission check
In BYONM mode the read permission checker allowed any path containing a
`node_modules` component without normalizing it first. A path such as
`./node_modules/../../../etc/passwd` therefore satisfied the check and was
read without `--allow-read`, since the un-normalized string can reach
`op_require_read_file` through a `node:module` `registerHooks` `load` hook.
Normalize the path with `deno_path_util::normalize_path` before looking for
the `node_modules` component so traversal sequences are collapsed first.
Legitimate paths inside `node_modules` are unaffected.
