Fix the URL path normalizer behind the fuzz test

An AI wrote a fuzz test for your URL path parser that only checks it does not crash. The fuzzer needs an oracle, a way to tell a right answer from a wrong one. So the team wants a normalizer that gives each path one standard form and never lets it climb above the root.

An assistant wrote normalize_path(raw). It is in the editor. It has a bug. Find it and fix it.

Input and output:

• raw: the URL path as it arrived. It can contain percent escapes such as %2e.
• Return the normalized path as a string, or "" to reject the path.

Rules the tests check:

• First decode two escapes: %2e becomes . and %2f becomes /. The letter can be either case, so %2E and %2F count too. Decode in one pass from left to right. Every other % sequence stays as it is.
• After decoding, a path that does not start with / is rejected. An empty input is rejected too.
• Split the decoded path on /. Drop empty segments (from // or a trailing /) and . segments.
• .. removes the last kept segment. A .. with no kept segment to remove would climb above the root, so the whole path is rejected.
• Keep every other segment exactly as it is, case included.
• Return / followed by the kept segments joined with /. With no kept segments, return /.