Bind symlinked rw/ro paths at the user-written destination

Canonicalizing rw/ro paths in the config layer resolved symlinks before
the sandbox was built, so a symlinked entry only appeared at its
target's location -- never at the path the user wrote. Stop
canonicalizing rw/ro at the config layer and instead resolve only the
source side of the bind in sandbox.rs.

src/sandbox.rs

@@ -180,17 +180,17 @@ fn ro_bind_under_tmpfs(cmd: &mut Command, base: &str, paths: &[&str]) {
 }
 
 fn add_rw_bind(cmd: &mut Command, path: &Path) -> Result<(), SandboxError> {
-    if !path.exists() {
-        return Err(SandboxError::PathMissing(path.to_path_buf()));
-    }
-    cmd.arg("--bind").arg(path).arg(path);
+    let source = resolve_bind_source(path)?;
+    cmd.arg("--bind").arg(source).arg(path);
     Ok(())
 }
 
 fn add_ro_bind(cmd: &mut Command, path: &Path) -> Result<(), SandboxError> {
-    if !path.exists() {
-        return Err(SandboxError::PathMissing(path.to_path_buf()));
-    }
-    cmd.arg("--ro-bind").arg(path).arg(path);
+    let source = resolve_bind_source(path)?;
+    cmd.arg("--ro-bind").arg(source).arg(path);
     Ok(())
 }
+
+fn resolve_bind_source(path: &Path) -> Result<PathBuf, SandboxError> {
+    std::fs::canonicalize(path).map_err(|_| SandboxError::PathMissing(path.to_path_buf()))
+}