allow_net does not restrict file:// $refs in schema built-ins

A file:// $ref in a JSON schema is resolved by opening the local path with os.Open, with no restriction of any kind. Because the schema operand of json.match_schema and json.verify_schema can come from input, untrusted data can drive local filesystem reads at evaluation time.

allow_netdoes not cover this — it gates hosts only, so setting it to[]` ("permit no host") still permits every file. We could extend allow_net to also disable files.