See #14083 for the longer story

This is not allowed in a theme/module:

[[module.mounts]]
source = '../../node_modules/bootstrap'
target = 'assets/vendor/bootstrap'

I suggest that we for a mount outside of the main project and the source starts with node_modules/ (or ../../node_modules/ to also allow existing setups work without modification):

• First check the local path.
• If not found, check relative to the project.

This should:

• Be OK security wise
• Me portable and much less brittle compared to the example in hugofs: Allow mounts within modules to access paths within the module and paths within the project. #14083.

/cc @jmooring