React processor can delete/break IRIS.DAT

[isc-tleavitt]

If $System.CSP.GetFileName(..publicURL) is empty - e.g., because the public URL doesn't match a web application - PerformActivateFileReplacements will try to perform replacements in the current directory, which may contain IRIS.DAT.

More generally, there should be validation that ..publicURL aligns to a web application and a descriptive failure if it doesn't.

Note: the React processor isn't documented and I'm sure nobody is using it yet, and you'd need a misconfigured module.xml to trigger this.