restrict SourcesPage to resources of the page's own package

[fr-manvi]

The source page parameter of the examples source browser goes straight into Class.getResourceAsStream(), so it is not limited to the package it claims to show:

• ?SourcesPage_class=org.apache.wicket.examples.helloworld.HelloWorld&source=/META-INF/NOTICE returns any class path resource, absolute names included
• source=../style.css walks out of the package the same way
• .class files are readable too, although the file browser deliberately filters them out

The page already computes the list of files it is willing to show, so the requested name is now checked against that list. Building the list also had to stop looking at only the first class path entry of the package, otherwise a package present in more than one entry loses files it should offer.

[fr-manvi]

CI is red on AsynchronousPageStoreTest.storeAsynchronousContextClosed, a flaky async timing test in wicket-core-tests. It's unrelated to this change, which only touches wicket-examples, and the reactor fails in core before it ever reaches the examples module. Would appreciate a review when you get a chance.

[fr-manvi]

The red check was an unrelated flake in AsynchronousPageStoreTest (async page-store timing on another thread), not from this change; the examples tests here pass locally. I rebased onto current master to get a clean run, but it's sitting in action_required, so it needs a maintainer to approve the workflow before it can go green.