Don't follow symlinks when processing PCAP uploads #1137

Tracks the fix for GHSA-98jw-5wq7-6qjv:
https://github.com/cisagov/Malcolm/security/advisories/GHSA-98jw-5wq7-6qjv

The PCAP upload watcher (pcap-monitor/scripts/watch-pcap-uploads-folder.py)
runs as root and checks and changes ownership of new uploads by path, using
calls that follow symlinks. The upload directory is writable through the
upload service's SFTP server, which permits creating symlinks, so the
watcher should never follow a symlink when handling an upload.

Changes:

• Inspect each upload with lstat() and remove symlinks and other
  non-regular entries instead of processing them
• Open uploads with O_NOFOLLOW and perform the ownership change, file type
  detection, and size check through that file descriptor
• Confirm the path still refers to the same file before moving or
  decompressing it
• Read compressed uploads through the same descriptor, and set ownership and
  mode on the decompression temp file through its descriptor rather than by
  path

Uploads of regular PCAP, compressed PCAP, and archive files are processed
as before.