Potential fix for code scanning alert no. 826: Uncontrolled data used in path expression

[kimocoder]

Potential fix for https://github.com/kimocoder/wifite2/security/code-scanning/826

Use a stricter allowlist-style approach for static assets: serve only files directly under static/ by filename, rejecting any request containing path separators or traversal-like forms. This preserves current behavior (the code already caches by filename = os.path.basename(file_path)) while eliminating uncontrolled path composition.

Best single fix in wifite/attack/portal/server.py (_serve_static_file):

1. Normalize requested segment (path[8:]) and reject empty input.
2. Require the normalized request to equal os.path.basename(...) (no subdirectories).
3. Use that safe basename for both cache lookup and filesystem join.
4. Build full_path from static_dir + safe_name, canonicalize once, do one containment check, then isfile.

This removes the duplicate full_path rebuild and duplicate commonpath check, and ensures the sink only receives a validated filename.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.