Stable v2.7.4 — Security

• fix(security): finish quota-bypass fix for site-nested resources
• fix(security): quota-bypass + errordoc path traversal (round-2 retry)
• fix(security): resolve 6 bugs found by round-2 adversarial review