prevent directory traversals below _base_ (fixes #2):

- unify read and size into Fs_common
- introduce check_filename which uses realpath to ensure that requested name is below base
- guard all file system accesses with check_filename
to get rid of the blocking, I should rewrite it in the shape of a lwt job? (if so, I'd need to get the macros and types from `lwt_unix.h`, or not?)