Fix security hole in ‘nix-store --serve’

Since it didn't check that the path received from the client is a
store path, the client could dump any path in the file system.