Add Windows filepath behavior clarifications

[mapalko]

📖 Description

Adds details to the schema documentation on filepath rules clarifying behavior on Windows. These changes describe behavior when root paths are added to a readwritePath rule and behavior around upward path traversals.

🔗 References

N/A -- standalone documentation improvement.

🔍 Validation

Visual inspection of the rendered markdown

✅ Checklist

• Signed the Contributor License Agreement
• Linked to an issue
• Updated documentation (if applicable)
• Updated Copilot instructions (if build, architecture, or conventions changed)
• If this PR changes Cargo.lock, the dependency-feed-check check passes (see docs/pull-requests.md)

📋 Issue Type

• Bug fix
• Feature
• Task

---

GitHub Actions runs the PR validation build automatically. The ADO pipeline
(MXC-PR-Build) is the Azure version of the PR pipeline, kept in parity with the GitHub
Actions build; it runs on merge to main, and Microsoft reviewers with write access can trigger it
on a PR with /azp run. See docs/pull-requests.md.

If the dependency-feed-check check fails on a new dependency, the crate must be added to
the feed before the PR can pass. See docs/pull-requests.md
for the steps.

Microsoft Reviewers: Open in CodeFlow

[Copilot]

Pull request overview

This PR updates the schema documentation (docs/schema.md) to clarify Windows filesystem-policy behavior, specifically around root-directory grants and scenarios where tools traverse upward through parent directories.

Changes:

• Add new Windows-specific documentation sections covering path grants vs. root directories and upward parent-directory traversal behavior.
• Fix a formatting/indentation issue in the final “See the tests/examples/…” line.

[MGudgin]

typo: BaseConatainer
incorrect capitalization: When

[MGudgin]

I feel like this advice cuts against least-privilege. The end result of this would be that access is granted too broadly. It basically says 'when granting access to c:\users\gudge\appdata\local\someapp also grant access to c:\users\gudge\appdata\local, c:\users\gudge\appdata, c:\users\gudge, c:\users and c:\

[daniedud-MSFT]

You're not wrong. The remediation for a tool behaving with this upwards search is:

1. Fix the tool to not do the upwards search.
2. Overprovision R/O access from Root.
3. MXC does work to accommodate this.

If the audience for this documentation is a tool maker, 1 is the best option.
If the audience for this documentation is a user without this kind of access to fix the tool, 2 is the best option (or choose a different tool).