STAC and OAProc fixes

[tomkralidis]

Overview

This PR fixes the following issues:

• STAC: further secures path traversal handling
• OAProc: prevent internal URL requests on process execution with subscribe objects defined, also introducing a configurable allow_internal_requests boolean for those wishing to explicitly allow internal request workflow

Note that this PR should be merged as 2 separate commits (and not squash merged).

Related Issue / discussion

TBD

Additional information

None

Dependency policy (RFC2)

• I have ensured that this PR meets RFC2 requirements

Updates to public demo

• I have ensured that breaking changes to the pygeoapi master demo server have been addressed
  • https://github.com/geopython/demo.pygeoapi.io/blob/master/services/pygeoapi_master/local.config.yml

Contributions and licensing

(as per https://github.com/geopython/pygeoapi/blob/master/CONTRIBUTING.md#contributions-and-licensing)

• I'd like to contribute [feature X|bugfix Y|docs|something else] to pygeoapi. I confirm that my contributions to pygeoapi will be compatible with the pygeoapi license guidelines at the time of contribution
• I have already previously agreed to the pygeoapi Contributions and Licensing Guidelines