[NO-ISSUE] Prevent directory escape bypass through repeated URL decoding

[tbonelee]

What is this PR for?

This PR addresses an issue in NotebookService where the notebook path validation only performs a single decoding pass.
This allowed a malicious user to bypass validation by double-encoding the ".." token.
By implementing the repeated decoding, we can prevent this bypass.
Additionally, to prevent excessive decoding attempts, a maximum limit on the number of decoding attempts has been added.

What type of PR is it?

Hot Fix

How should this be tested?

• CI

Questions:

• Does the license files need to update? No
• Is there breaking changes for older versions?
  • There may be minor compatibility issues if a user relies on multiple encoded paths, but this is unlikely in realistic scenarios.
• Does this needs documentation? No

[tbonelee]

cc @jongyoul