Don’t allow source files outside of the source root

[Fil]

For example, if a markdown page link.md has: <link href=../../../Downloads/dark.css> the yarn build command should ignore it.

[EDITED] currently we see the file being written:
copy ../../Downloads/dark.css → ../Downloads/dark.css
this ends up, in my case, in /Users/fil/Source/Downloads/dark.css, since I am working from /Users/fil/Source/ci/.

and the yarn dev command returns a page containing <link href="/_file/../../../Downloads/dark.css"> which it doesn't know how to serve because it results in the path /Downloads/dark.css.

If we want to support linking to files outside of docs/, then maybe we need to be more vigilant about the path rewrite; but it would seem simpler and safer to not allow that?

(may be related to #30 #40 #54)

[cinxmo]

I personally don't think we should be able to link any local files outside of our project root directory (currently docs but we can overwrite it)

[mbostock]

We should error/ignore relative paths that go outside of the source root. You should be required to move the source file into the source root for it to work (and therefore it should be safe to preserve the relative path as-is when copying to the output root).