Close marketplace path containment gap

CHANGELOG · original

Fixed a case where a marketplace entry path containing a backslash could bypass the containment check for fetched marketplaces on macOS and Linux