fix: apply `securePath` to package bin

[antongolub]

What / Why

• Aligns path normalization logic when processing bin and man refs.
• Fixes out of scope path traversals for bin

function unixifyPath (ref) {
  return ref.replace(/\\|:/g, '/')
}

function securePath (ref) {
  const secured = path.join('.', path.join('/', unixifyPath(ref)))
  return secured.startsWith('.') ? '' : secured
}

function secureAndUnixifyPath (ref) {
  return unixifyPath(securePath(ref))
}

References

continues #100, #104