clean up CVE variant vulnerabilities #408

Ack release 3.10.0 addressed vulnerabilities in three CPANsec CVEs consolidated from five responsible-disclosures from researchers (Thank you!), and completely addressed one of the three (CVE-2026-49146). The other two (CVE-2026-49145, CVE-2026-49147) have additional esoteric exploitation paths not addressed in 3.10.0.

Also needed to clean up 3.10.0 —

• 3.10.0 also had collateral damage wrto Unicode filenames reported in issue Loosing unicode filenames #405
• one CVE test case won't reproduce on Windows so make test with that test-case fails while setting up; fixed in PR disable test with : on WIN #400 (skip do-not-care test on WIN), already merged on DEV but not in release yet.