prevent directory traversals below _base_ (fixes #2):

- unify read and size into Fs_common
- introduce check_filename which uses realpath to ensure that requested name is below base
- guard all file system accesses with check_filename
since mirage-fs-unix is independent of cohttp, I'd rather fix it here than in cohttp (which still should normalise the request) -- there might be other users of mirage-fs-unix (other web servers, etc.), and the behaviour of mirage-fs-unix should be the same as crunch - thus not allowing to escape base.