core: Validate file names read from directory variants

In a future where we pull data from remote servers, we don't want
to allow path uplinks.

src/libostree/ostree-repo-file.c

@@ -236,6 +236,9 @@ do_resolve_nonroot (OstreeRepoFile     *self,
 
       g_variant_get_child (container, i, "(&s&s&s)",
                            &name, &content_checksum, &metadata_checksum);
+
+      if (!ot_util_validate_file_name (name, error))
+        goto out;
           
       if (!ostree_repo_load_variant_checked (self->repo, OSTREE_SERIALIZED_TREE_VARIANT,
                                              content_checksum, &tree_contents,