prevent directory traversals below _base_ (fixes #2):

- unify read and size into Fs_common
- introduce check_filename which uses realpath to ensure that requested name is below base
- guard all file system accesses with check_filename
This can block indefinitely. Also, PATH_MAX may not be defined and the `resolved_path==NULL` feature should be used to get a malloc'd buffer (and then copy to an OCaml string and `free`).