WW-5645 Harden static content path handling and remove redundant URL decode

[arunmanni-ai]

The buildPath() method in DefaultStaticContentLoader applied
URLDecoder.decode() to resource paths that the servlet container
had already decoded. This redundant decode served no purpose and
conflicted with the servlet spec's path handling contract.

This patch:

• Removes the unnecessary URLDecoder.decode() call from buildPath()
• Adds a shared Validator.containsMalformedPathSegment() utility
  that rejects dot-dot sequences, backslash separators, and
  percent-encoded forms that have no place in normalised resource paths
• Applies the check in both the static content and WebJar serving paths
• Documents the encoding contract on RequestUtils.getServletPath()
• Adds test coverage for malformed path rejection