fix(deploy): reject encoded traversal in control proxy

install.sh

@@ -166,18 +166,21 @@ function reject(response, status, message) {
 
 const server = https.createServer(options, (request, response) => {
   let target;
+  let decodedPath;
   try {
     target = new URL(request.url ?? "/", "https://control-proxy");
+    decodedPath = decodeURIComponent(target.pathname);
   } catch {
     reject(response, 400, "invalid request target");
     return;
   }
   if (target.origin !== "https://control-proxy" || target.username || target.password ||
-      target.pathname.includes("..") || target.pathname !== "/health/live" && !target.pathname.startsWith("/internal/v1/")) {
+      decodedPath.includes("..") || decodedPath.includes("\u0000") ||
+      decodedPath !== "/health/live" && !decodedPath.startsWith("/internal/v1/")) {
     reject(response, 404, "not found");
     return;
   }
-  if (target.pathname === "/health/live") {
+  if (decodedPath === "/health/live") {
     response.writeHead(200, {"content-type": "application/json"});
     response.end('{"status":"live"}');
     return;