Unauthenticated local-file disclosure via plugin path traversal

Grafana 8.0.0-beta1 through 8.3.0 allows remote attackers to read local files through a public plugin asset URL. The getPluginAssets handler cleans the requested path without first anchoring it to the plugin root, then joins attacker-controlled traversal segments to the plugin directory; the fix normalizes an absolute path, derives a relative path, and confines the join. No authentication or user interaction is required, so any network-reachable self-hosted instance can disclose files readable by the Grafana process; Grafana Cloud was not affected.