Fix path traversal security vulnerability by canonicalizing path names of every inodes and discarding inodes with a path pointing outside of the extraction directory.
Fix path traversal security vulnerability by canonicalizing path names of every inodes and discarding inodes with a path
pointing outside of the extraction directory.

Fix path traversal through symlinks by canonicalizing link target path using the extraction directory as root. If the link
still points outside the extraction root, it gets discarded. This way symlinks reflects the reality of a filesystem on device
by pointing to files within the extracted filesystem instead of files from the host executing jefferson.

sviehb/jefferson