Using ".." allows loading elements from outside of `element-path`

If I have a project with the conventional `element-path: elements`, I can write an element in the root directory of the project (say `test.bst`) and bst will happily load it if I do `bst show ../test.bst` or `bst build ../test.bst`.

Reproduce the issue in a project using the conventional element-path: elements setting, then run `bst show ../test.bst` and `bst build ../test.bst` with an element outside that directory. Trace the element-path validation for these commands and consider the issue done when both commands reject elements outside the configured path.

Written by the indexing model from the issue text.