buildah: Use either openat2(RESOLVE_BENEATH) or don't follow links

[cgwalters]

I came across this bit of code that runs after the just-built image is mounted (to be passed to scanners):

https://github.com/konflux-ci/build-definitions/blame/38c6cd3f4733ed1ee638ce43bacd1096e3e5076d/task/buildah-remote/0.2/buildah-remote.yaml#L487

What would be a lot less ugly than just blowing away all symbolic links is using Linux's openat2 system call has RESOLVE_IN_ROOT which allows a process to safely inspect a distinct root and resolve any symlinks as if they're in that root.

Or perhaps simpler often, just...don't follow symlinks in whatever is doing this scanning. (Why would it traverse symlinks?)