fix(middleware): escape static directory listing links

[yuefdev]

Directory browsing puts the display name directly in href. Names such as hash#file.txt and query?.txt become fragments or queries, while colon:name.txt is blocked by html/template as a URL scheme.

Build a relative URL from the filename and use it in the default template, keeping the display name unchanged. Custom templates can use the new URL field; the existing fields remain available.

The regression follows the rendered link through Echo, dropping fragments as a browser does. Four cases fail before the fix; plain names, spaces, percent signs and ampersands remain covered.

Validation: all static middleware tests, go vet ./..., golint, staticcheck and gofmt pass. The full go test -race ./... passes on Ubuntu with Go 1.27.0; the Windows race run could not start because cgo is disabled there.