Fix for CVE-2021-22151 (Kibana path traversal issue) can be bypassed on Windows

Hello team, I hope you're doing well! I was combing through your GitHub repository to look at the fixes for recent security releases and found [the fix for CVE-2021-22151](https://github.com/elastic/kibana/pull/107768) to be incomplete. The current fix makes assumptions that are true on Linux but …

      const range = path.normalize(request.params.range);
      return range.startsWith('..')
        ? response.notFound()
        : new Promise((resolve) => {
            const fontPath = path.join(__dirname, 'fonts', 'open_sans', `${range}.pbf`);
            fs.readFile(fontPath, (error, data) …