fix(npm): normalize path in BYONM read permission check (#35882)
When BYONM is enabled, the npm read permission checker treated any path
containing a `node_modules` component as readable without consulting
`--allow-read`. The path was not normalized before that check, so a
traversal sequence like `./node_modules/../../../etc/passwd` still
contained a `node_modules` component and was allowed through, letting it
be read outside of `node_modules`.
Normally `require` normalizes a path before it reaches
`op_require_read_file`, which collapses the `..` segments and removes
the `node_modules` component, so the check behaves correctly. However a
`node:module` `registerHooks` `load` hook can pass an un-normalized path
straight to `op_require_read_file`, bypassing that normalization.
The fix normalizes the path with `deno_path_util::normalize_path` before
looking for the `node_modules` component, so `.`/`..` segments are
collapsed first and a path that escapes `node_modules` falls through to
the regular read permission check. Paths that genuinely live inside
`node_modules` (including ones with interior `..` that stay within the
tree) are unaffected.
A spec test is added to the existing `byonm_main_path_traversal` suite
that drives the `registerHooks` path and asserts the read is denied.
