Problem/Motivation
\Drupal\file\Plugin\rest\resource\FileUploadResource is using PHP's builtin basename() which is vulnerable to https://bugs.php.net/bug.php?id=77239
Proposed resolution
Use \Drupal\Core\File\FileSystem::basename() instead and add test coverage.
Remaining tasks
User interface changes
none
API changes
none
Data model changes
none
Release notes snippet
n/a