Optionally harden symlink accesses.

Based conceptually on grsecurity's GRKERNSEC_SYMLINKOWN feature, we hook into
following the symlinks.  Unlike grsecurity's solution, the method we use is
uglier due to the requirements of being a loadable module.

We hook the security_inode_follow_link() function and then follow the symlink.
This means we resolve the symlink twice per VFS operation, but the performance
hit does not seem to be too bad.

Signed-off-by: William Pitcock <nenolod@dereferenced.org>