manifest: add basic path checks for <copyfile> & <linkfile>

Reject paths in <copyfile> & <linkfile> that point outside of their
respective scopes.  This validates paths while parsing the manifest
as this should be quick & cheap: we don't access the filesystem as
this code runs before we've synced.

Bug: https://crbug.com/gerrit/11218
Change-Id: I8e17bb91f3f5b905a9d76391b29fbab4cb77aa58
Reviewed-on: https://gerrit-review.googlesource.com/c/git-repo/+/232932
Tested-by: Mike Frysinger <[email protected]>
Reviewed-by: Mike Frysinger <[email protected]>
Reviewed-by: Michael Mortensen <[email protected]>
diff --git a/docs/manifest-format.md b/docs/manifest-format.md
index 93d9b96..a39f97e 100644
--- a/docs/manifest-format.md
+++ b/docs/manifest-format.md
@@ -338,7 +338,7 @@
 instead of copying it creates a symlink.
 
 The symlink is created at "dest" (relative to the top of the tree) and
-points to the path specified by "src".
+points to the path specified by "src" which is a path in the project.
 
 Parent directories of "dest" will be automatically created if missing.