fix: prevent loading env outside of root

[bluwy]

Description

Fixes #6933
Fixes #5712

Loading env files will only load from the envDir only, anything above the directory is not checked.

Additional context

---

What is the purpose of this pull request?

• Bug fix
• New Feature
• Documentation update
• Other

Before submitting the PR, please make sure you do the following

• Read the Contributing Guidelines.
• Read the Pull Request Guidelines and follow the Commit Convention.
• Check that there isn't already a PR that solves the problem the same way to avoid creating a duplicate.
• Provide a description in this PR that addresses what the PR is solving, or reference the issue that it solves (e.g. fixes #123).
• Ideally, include relevant tests that fail without this PR but pass with it.

[Niputi]

is the new option really needed? it looks like a case which was not accounted for in implementation.
shouldn't the envDir function give the needed functionality for monorepo users and non-monorepo users?

[bluwy]

Yeah I don't think it's needed too. We could remove it and disclose as a "bug fix", but it feels like it could be a breaking change so I played it safe here. Definitely open for discussion though.

[bluwy]

Been thinking about it and I think it makes sense to just remove the option. I don't see a usecase where someone intend to load .env files above the envDir. Will push another commit.

[patak-dev]

To play safe, let's merge this one in the 2.9 beta period (I think we should start it in a week from now).

[ydcjeff]

Should we add a note to the docs?
https://vitejs.dev/config/#envdir

[bluwy]

I think the docs are fine right now with "The directory from which .env files are loaded". The behaviour which it loads .env files above the envDir sounds like a bug, as the docs didn't imply that.