prevent directory traversals below _base_ (fixes #2):

- unify read and size into Fs_common
- introduce check_filename which uses realpath to ensure that requested name is below base
- guard all file system accesses with check_filename
or alternatively do the same as https://github.com/mirage/ocaml-uri/blob/master/lib/uri.ml#L338 instead of calling out to C!?