22: FTP wildcard matching decodes server-provided filenames, enabling directory traversal

When `CURLOPT_WILDCARDMATCH` is enabled, libcurl concatenates the server-provided LIST filename directly onto the wildcard path and then URL-decodes the combined string. A filename containing percent-encoded path separators (e.g. `%2e%2e%2fsecret.txt`) is decoded into `../secret.txt`, causing …

char *tmp_path = curl_maprintf("%s%s", wildcard->path, finfo->filename);