Bash path-restriction checks now track cd/pushd/popd across compound commands

Bash path-restriction checks now follow directory changes across a compound command. A new walk tracks cd, chdir, pushd, and popd (including popping the pushd stack) through a command's statement list, so later commands in the same line are evaluated against deny rules relative to the resolved working directory. If a cd target can't be resolved, subsequent reads are denied rather than silently checked against the wrong directory.