fix: remove dependency, ensure resolved path is in scope

[markhughes]

Closes: ??

What are the changes and their implications?

This ensure the the resolved path is always in the correct scope.

Moved logic from valid-filename into package, with plans to expand this (as it's missing some rules).

Checklist

• [ ] Changes covered by tests (tests added if needed)
• [ ] PR submitted to droppyjs.com for any user facing changes