Implemented safe_open() in order to avoid symlink race conditions.

It makes sure that we do not follow unsafe symlinks, that is a link
that belongs to a user, but has a target owned by a different user.
It does this in a way that avoids race conditions (between testing if
a file is a link, and opening that file, there is a small window of
opportunity).

Also implements safe_chdir(), to also safeguard chdir() operations.

Fixes issue #3693.