Improve security of get_runtime_dir(strict=False)

Fixes fd.o bug #73878.