Merge pull request #5720 from cyphar/5656-cp-absolute-paths

Ensure `docker cp` cannot traverse outside container rootfs