fix(fs): normalize destination path in TmpFs::rename_async

[da1suk8]

Summary

TmpFs::rename_async joined the destination onto the root without try_normalize, unlike rename_sync and every other path in TmpFs. A .. destination escaped the tmp root, and an absolute one replaced it (Path::join returns absolute paths as-is). Not reachable from user workers today (Deno.rename is blocklisted), but reachable from the main worker and embedders.

Validation

• New tests: in-root rename still works; .. and absolute destinations return InvalidInput, matching rename_sync, with nothing created outside the root.
• Reverting the one-line fix makes the rejection test fail.