Arbitrary file read and write via fixture traversal

Path traversal in Saloon before 4.0.0 allows remote attackers to read or write process-accessible files through crafted fixture names. The fixture layer joins an unvalidated fixture name to the configured fixture directory, so ../ segments can escape its boundary during mock reads or response recording. Exploitation requires an application to derive a fixture name from attacker-controlled input, and access is limited to files readable or writable by the PHP process.