Out-of-root file operations via unchecked notebook paths

Path traversal in Apache Zeppelin 0.9.0 through 0.12.0 allows remote authenticated users to alter files outside the notebook root. NotebookRepo.buildNoteFileName concatenates user-supplied note paths after checking only for a leading slash, while FileSystemNotebookRepo folder move and remove paths bypass that builder, so dot segments resolve outside the configured root. FileSystemNotebookRepo must be configured, and the account must be permitted to rename a note or perform folder operations; the server or Hadoop identity can then move, write, or delete notebook files or directories outside the root.