Root privilege escalation via sourcefilename path traversal

Path traversal in Jobe 1.6.4 and earlier allows remote attackers to write PHP files into the web root through a crafted sourcefilename. The runs_post handler uses sourcefilename as a filesystem path without rejecting directory separators or leading dots, so ../ segments escape the job directory. Reachability to the runs API is sufficient in the default configuration; the resulting PHP executes as the web server user and enables replacement of runguard to gain root.