Restrict file inclusion in low security level

[r1kka6]

Summary

• allow only the built-in challenge pages in the low-level file inclusion handler
• reject arbitrary local paths before the shared include() sink is reached

Verification

• docker run --rm -v "$PWD":/work -w /work php:8.3-cli php -l vulnerabilities/fi/source/low.php
• vulnerable baseline renders /etc/passwd for page=/etc/passwd
• patched runtime returns ERROR: File not found! for the same payload and still serves page=include.php