Ensure `docker cp` cannot traverse outside container rootfs

This patch fixes the bug (#5656) that allowed cp to copy files outside of the containers rootfs, by passing a relative path (such as ../../../../../../../../etc/shadow). This is fixed by first converting the path to an absolute path (relative to /) and then appending it to the container's rootfs before continuing.

Docker-DCO-1.1-Signed-off-by: Aleksa Sarai <cyphar@cyphar.com> (github: cyphar)

/cc @shykes @creack @vieux @crosbymichael