ISR: contain cache keys within filesystem cache roots on Windows

## Next.js Change

**Commit:** [`09f9c8a`](https://github.com/vercel/next.js/commit/09f9c8a758a6b20f248b0e90e539bba8225c73bb)
**PR:** [#97876](https://github.com/vercel/next.js/pull/97876)

## What changed

Next.js now percent-encodes backslashes as path delimiters when building route segments and validates every filesystem incremental-cache key after joining it to its cache root. The cache path must equal the root or begin with `root + path.sep`; otherwise the request fails.

This closes a Windows-specific traversal: a dynamic segment containing encoded backslashes could form `..\..\...` during ISR cache lookup and escape the intended pages/app/fetch cache directory. Upstream added production Windows coverage that attempts to read `server-reference-manifest.json` through an ISR route.

## Impact on vinext

vinext implements ISR and supports filesystem-related build/cache paths on Windows. Audit all cache persistence adapters and route-to-cache-key construction to ensure user-controlled route segments cannot introduce platform path separators or escape their intended storage namespace.

What to check/do:

1. Treat both `/` and `\` as route segment delimiters when canonicalizing user-controlled path segments.
2. Where a cache implementation converts a key to a filesystem path, validate the resolved/joined result remains inside its fixed root using native path semantics.
3. Add Windows-gated regression coverage using percent-encoded backslashes and traversal-shaped ISR route segments.
4. Verify Pages and App Router behavior, including any configured persistent cache adapter.

## Related

- Next.js upstream regression: `test/e2e/incremental-cache-path-traversal/`

Start by auditing vinext's ISR cache persistence adapters and route-to-cache-key construction, then compare their behavior with the upstream regression in test/e2e/incremental-cache-path-traversal/. Exercise percent-encoded backslashes and traversal-shaped segments on Windows for both Pages and App Router paths. Done means resolved cache paths remain within their filesystem roots and Windows-gated regression coverage passes, including configured persistent adapters.

Written by the indexing model from the issue text.