daemon: container: properly handle copying of absolute symlinks

Before this patch, a symbolic link pointing to an absolute path (such as
/etc/passwd, etc) would be copied from the *host* system, leading to
information disclosure. Since the docker daemon runs as root, this
symlink bug could cause essentially *any* file to be copied from the
host system (and the file mode was changed to be owned by the user which
copied the file). This vulnerability was caused by the container.Copy
method not properly accounting for absolute paths in symlinks.

This patch fixes the above vulnerability by ensuring that, when copying
files, if the file is a symlink, the symlink is first resolved (and
converted into a relative path) and then recursed until the final target
is found, where regular copying will continue. This both fixes the
original vulnerability, and fixes other potential vulnerabilities (such
as chaining of symlinks to try to attempt the above vulnerability).

Docker-DCO-1.1-Signed-off-by: Aleksa Sarai <cyphar@cyphar.com> (github: cyphar)