internal/pkg: optionally validate flat pathnames

This makes the decoder safe against untrusted input without hurting performance for a trusted stream. This should still not be called against untrusted input though.

Signed-off-by: Ophestra <cat@gensokyo.uk>

internal/pkg/dir_test.go

@@ -85,7 +85,7 @@ func TestFlatten(t *testing.T) {
 					t.Fatalf("Flatten: error = %v", err)
 				}
 
-				s := pkg.NewDirScanner(bytes.NewReader(buf.Bytes()))
+				s := pkg.NewDirScanner(bytes.NewReader(buf.Bytes()), true)
 				var got []pkg.FlatEntry
 				for s.Scan() {
 					got = append(got, *s.Entry())