Preserve the root when removeDotSegments pops past it (RFC 3986 §5.2.4) - #190

Summary

UriString::removeDotSegments() drops the leading slash when a .. segment pops past the root, turning an absolute path into a rootless (relative) one. Per RFC 3986 §5.2.4, popping at the root operates on the (empty) output buffer, so the leading / is preserved.

UriString::removeDotSegments('/../a');           // "a"    — RFC: "/a"
UriString::removeDotSegments('/a/b/../../../c');  // "c"    — RFC: "/c"
UriString::removeDotSegments('/../../');          // ""     — RFC: "/"

The explode('/') + array_reduce shortcut represents the leading / as an empty first segment; when .. triggers array_pop, that empty marker is removed along with a real segment, so the root is lost.

Because foo:/../a and foo:a identify different resources (absolute vs. rootless path, RFC 3986 §3.3), this is also visible through the public helpers:

UriString::normalize('foo:/../a');                    // "foo:a"        — RFC: "foo:/a"
UriString::normalize('file:/../etc/passwd');          // "file:etc/passwd" — RFC: "file:/etc/passwd"
Path::new('/../a')->withoutDotSegments()->toString(); // "a"            — RFC: "/a"

Fix

BaseUri::removeDotSegments() already carries this exact guard (with the comment "added because some PSR-7 implementations do not respect RFC3986"); it was never back-ported to the canonical UriString implementation. This restores the leading slash only when the input path was absolute:

if (str_starts_with($path, '/') && !str_starts_with($newPath, '/')) {
    return '/'.$newPath;
}

Scope / no regression

• resolve() is unchanged: it already re-prepends / for URIs with an authority, so resolution was correct and stays byte-identical. The full RFC 3986 §5.4 resolution corpus (resolveProvider, extraResolutionProvider) still passes.
• The guard fires only when an absolute path would otherwise become rootless. Relative paths stay relative (a/../b -> b) and non-overshoot paths are untouched (/a/b/../c -> /a/c), so no existing behaviour changes.
• New data-provider test covers the overshoot cases, the unchanged absolute/relative cases, and normalize() on a scheme-only URI.