unpack: insufficient pathname sanitisation

[cyphar]

Currently we aren't properly cleaning paths inside unpackEntry. In particular, if you have an invalid tar archive that contains entries such as ../../ or if it contains a entry that resolves through a symlink, then umoci will start touching parts of the host.

To fix this we need to use this library, which I helped write specifically to solve this problem inside Docker https://github.com/docker/docker/tree/master/pkg/symlink.

[cyphar]

This has been fixed in 3da965c. I'm working on adding tests for this.