Path traversal in rio-vt Kitty graphics protocol handler allows out-of-bounds file delete (and read)

SSRF and local file disclosure via unvalidated URLs