Rewrites function bypasses secure_rewrites setting

## Description

Using a rewrites function allows you to access other paths that secure_rewrites usually blocks.

## Steps to Reproduce

```
~$ curl -X PUT 'http://127.0.0.1:5984/r'
{"ok":true}

~$ curl -X PUT 'http://127.0.0.1:5984/r/_design/n' -d $'{"rewrites": "function (r) { return { path:\'../../../\' + r.path.slice(4).join(\'/\') } } "}'
{"ok":true,"id":"_design/n","rev":"1-08f4fea4ee5b841159d913a4aa25d6c7"}

~$ curl 'http://127.0.0.1:5984/r/_design/n/_rewrite/_uuids'
{"uuids":["6c59d2b3e582f05f7589fc2cef0a49c4"]}
```

## Expected Behaviour

The final curl above should have returned "insecure_rewrite_rule" since it allowed access to the root even though secure_rewrites is turned on. That is what happens for rewrite rules like:

```
~$ curl -X PUT 'http://127.0.0.1:5984/r/_design/m' -d $'{"rewrites": [{"from": "*", "to": "../../../*"}] }'
{"ok":true,"id":"_design/m","rev":"1-6c7cb91e520f4bc9cfe7f33790336159"}

~$ curl 'http://127.0.0.1:5984/r/_design/m/_rewrite/_uuids'
{"error":"insecure_rewrite_rule","reason":"too many ../.. segments"}
```

## Your Environment

```
~$ curl http://127.0.0.1:5984
{"couchdb":"Welcome","version":"2.3.0","git_sha":"07ea0c7","uuid":"e07d95a0b0610b7bcb8e046fff5dd1b6","features":["pluggable-storage-engines","scheduler"],"vendor":{"name":"The Apache Software Foundation"}}
```

Start by reproducing the two curl examples with secure_rewrites enabled, then trace the rewrite-function path handling and the secure_rewrites check. Done means function-based rewrites reject traversal to the CouchDB root with the same insecure_rewrite_rule response as rule-based rewrites.

Written by the indexing model from the issue text.