Function to_local_path 

pub fn to_local_path(uri: &Url) -> Option<PathBuf>

Map one portal-returned URI to a local path, or None if it does not name a file on this machine.

Builds on url::Url::to_file_path, which is already much stricter than a strip_prefix("file://"): it requires the file scheme, rejects a URI naming any host other than the empty host or localhost, and requires an absolute path.

It is not strict enough on its own, though. to_file_path percent-decodes each segment and then joins, so a segment the portal presented as a single file name can decode into several path components: a%2Fb.txt becomes a/b.txt, and %2E%2E becomes a parent-directory hop. A chosen name would then reach outside the directory the user actually browsed. So we also require that the decoded path has exactly as many components as the URI had segments, and that none of them is .. or ..