fix(loading): resolve absolute in-root paths under WithRoot

[fredbi]

os.Root only accepts paths relative to its root and rejects any absolute path, even one that points inside the root. But callers that normalize references to absolute paths before loading — notably github.com/go-openapi/spec, which resolves every $ref to an absolute path against the spec's base — then had every confined read rejected, making WithRoot unusable for its primary purpose: safely resolving references in an untrusted document.

Rebase an absolute requested path onto the root (via filepath.Rel) before handing it to os.Root:

• a relative path is passed through unchanged (os.Root confines it, including ".." traversal and symlink escapes);
• an absolute path inside the root is rebased to a root-relative path and read;
• an absolute path outside the root yields a "../" prefix and is rejected by os.Root;
• a path that cannot be made relative to the root (e.g. a different volume on Windows) makes filepath.Rel return an error, which is propagated as a rejection rather than allowed to escape.

Symlink-escape protection is preserved: the rebase is purely lexical; the actual open still goes through os.Root, which resolves every path component within the root. Default behavior (no WithRoot) is unchanged.

Change type

Please select: 🆕 New feature or enhancement|🔧 Bug fix'|📃 Documentation update

Short description

Fixes

Full description

Checklist

• I have signed all my commits with my name and email (see DCO. This does not require a PGP-signed commit
• I have rebased and squashed my work, so only one commit remains
• I have added tests to cover my changes.
• I have properly enriched go doc comments in code.
• I have properly documented any breaking change.

[codecov]

Codecov Report

❌ Patch coverage is 66.66667% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 92.17%. Comparing base (221c895) to head (7d3a863).
⚠️ Report is 1 commits behind head on master.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
loading/options.go	66.66%	2 Missing and 2 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #224      +/-   ##
==========================================
- Coverage   92.29%   92.17%   -0.12%     
==========================================
  Files          57       57              
  Lines        2674     2685      +11     
==========================================
+ Hits         2468     2475       +7     
- Misses        164      166       +2     
- Partials       42       44       +2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.