Move the rate limit budget consumption (record_action) to immediately
after the path allowlist check but before canonicalization. Previously,
an attacker could probe whether arbitrary paths exist via canonicalize
errors without consuming any rate limit budget, since record_action
was only called after the file size check.
Now every request that passes the basic path validation consumes rate
limit budget, regardless of whether the file exists.
Closes#354
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
c54bfe3814