archive: harden tar extraction against path traversal - #45

Addresses ART-224 and the cluster of externally reported tar-extraction
breakouts (Windows BuildKit ADD/build, and docker cp on all platforms).

- Reject traversal entries instead of clamping them: normalize hdr.Name
  with path.Clean(strings.TrimLeft(name, "/")) and reject non-local names
  via filepath.IsLocal, in both Unpack and UnpackLayer.
- Bound extraction with os.Root (openat-based); create symlinks with
  root.Symlink (target stored verbatim, so absolute targets are kept) and
  hardlinks with root.Link plus a filepath.IsLocal defence-in-depth check.
- Cache the most recent parent directory fd (dirCache) so consecutive
  entries in the same directory use *at(2) syscalls, amortizing os.Root's
  per-call path re-evaluation.
- Resolve symlink components with fsRootPath, a straight fork of
  containerd/continuity fs.RootPath (path.go + path_test.go), un-exported
  and trimmed to the functions used, to ease upstream sync.
- tar header names are POSIX; convert to native paths with
  filepath.FromSlash at each os.Root / filesystem boundary, and skip
  entries whose name or hardlink target Windows cannot represent (":", "\").

archive: make lchtimes use os.Root for path resolution

Resolve the parent directory through os.Root and perform utimensat(2)
relative to the opened directory instead of using an absolute host path.

This preserves os.Root's path containment guarantees while still updating
the symlink itself using AT_SYMLINK_NOFOLLOW.

createImpliedDirectories: Keep implied dirs at ImpliedDirectoryMode under umask

createImpliedDirectories previously used user.MkdirAllAndChown, whose
setPermissions runs os.Chmod after creation, so implied parent
directories always ended up with ImpliedDirectoryMode regardless of the
process umask.

The os.Root rewrite creates them with root.Mkdir only, which applies the
mode subject to umask: under umask 0o027 an implied directory became
0o750 instead of 0o755.

Re-apply the mode with root.Chmod after each successful Mkdir so implied
directories keep ImpliedDirectoryMode independent of umask, matching the
prior behavior and the function's documented contract.

Co-authored-by: Cesar Talledo <cesar.talledo@docker.com>
Co-authored-by: Paweł Gronowski <git@grono.dev>
Co-authored-by: Sebastiaan van Stijn <github@gone.nl>
Signed-off-by: Cesar Talledo <cesar.talledo@docker.com>
Signed-off-by: Paweł Gronowski <git@grono.dev>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

os.Root.Chmod relies on chmodat(AT_SYMLINK_NOFOLLOW), which is not
supported on all Linux kernels and filesystems.

When that operation fails with ENOTSUP or EOPNOTSUPP, fall back to
chmod relative to the resolved parent directory. Symlink entries are
excluded beforehand, and hardlink entries are only chmod'd when their
target is not a symlink, preserving the existing no-follow semantics.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

Some code-paths may return an error, in which case creating the parent
paths isn't needed. Move it later in the function to avoid this.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

Open newly-created implied directories once and apply ownership and
permissions through the retained handle instead of separate os.Root
operations.

This avoids repeated doInRoot path resolution for Lchown/Chmod while
continuing to apply metadata only to newly-created directories.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

Pass the extraction root to the overlay whiteout converter and operate
relative to opened directories instead of resolving absolute paths with
fsRootPath. This avoids redundant path resolution before os.Root-based
operations while reducing the TOCTOU surface.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

Pass os.Root into handleTarTypeBlockCharFifo and perform the
filesystem operation relative to the opened parent directory instead
of constructing an absolute path.

This removes an fsRootPath call, avoids an extra pathname resolution,
and keeps the operation within os.Root.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>