vfs: sanitize paths

[barraguda]

Problem

Current paths are often manipulated as strings in the vfs, leading way to attacks that use relative paths, like "/mypkg:mypub.os/pkg/../../some_other_pkg/other_file".

Solution

Canonicalize paths into absolutes, removing any relative paths and checking the absoluts.

Docs Update

Corresponding docs PR

Notes

thanks @bonedaddy for bringing it up in discord!
Caps are matched on literally, so a missing prepended "/" to a path doesn't matter when interacting with the vfs, but when doing get_capability() from the kernel it does.

[dr-frmr]

not bad, any changes required in API docs?

[barraguda]

not bad, any changes required in API docs?

nope, not anymore.

Am doing path normalization instead of canonicalization now as the latter requires the path to exist, which often in our case it does not.

[dr-frmr]

LGTM