Correct --root-dir check to also work for jar:file: URIs (#1442)

pkl-core/src/test/kotlin/org/pkl/core/EvaluatorTest.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -283,6 +283,57 @@ class EvaluatorTest {
       )
   }
 
+  @Test
+  fun `cannot import module from zip filesystem located outside root dir`(
+    @TempDir tempDir: Path,
+    @TempDir forbidden: Path,
+  ) {
+    val evaluator =
+      with(EvaluatorBuilder.preconfigured()) {
+        rootDir = tempDir
+        build()
+      }
+
+    val zipFile = createModulesZip(forbidden)
+
+    val module =
+      tempDir
+        .resolve("test.pkl")
+        .writeString("res = import(\"jar:${zipFile.toUri()}!/foo/var/module1.pkl\")")
+
+    val e = assertThrows<PklException> { evaluator.evaluate(path(module)) }
+    assertThat(e)
+      .hasMessageContaining(
+        "Refusing to load module `jar:${zipFile.toUri()}!/foo/var/module1.pkl` because it is not within the root directory (`--root-dir`)."
+      )
+  }
+
+  @Test
+  fun `cannot read resource from zip filesystem located outside root dir`(
+    @TempDir tempDir: Path,
+    @TempDir forbidden: Path,
+  ) {
+    val evaluator =
+      with(EvaluatorBuilder.preconfigured()) {
+        rootDir = tempDir
+        allowedResources.add(Pattern.compile("jar:file:"))
+        build()
+      }
+
+    val zipFile = createModulesZip(forbidden)
+
+    val module =
+      tempDir
+        .resolve("test.pkl")
+        .writeString("res = read(\"jar:${zipFile.toUri()}!/foo/var/module1.pkl\")")
+
+    val e = assertThrows<PklException> { evaluator.evaluate(path(module)) }
+    assertThat(e)
+      .hasMessageContaining(
+        "Refusing to read resource `jar:${zipFile.toUri()}!/foo/var/module1.pkl` because it is not within the root directory (`--root-dir`)."
+      )
+  }
+
   @Test
   fun `cannot read resource located outside root dir`(@TempDir tempDir: Path) {
     val evaluator =