fn validate_write_destination(root: &Path, path: &Path) -> Result<()>
Resolves a write destination below a trusted root without following a final symlink.