Verify extracted item paths stay inside the backup directory

archive.GetItemFilePath/GetVersionedItemFilePath joined the group resource,
namespace and name into a path without checking the result against rootDir.
Those components can come from backup contents - the additional items a
RestoreItemAction returns are built from annotations on a backed up object -
so a component containing ".." resolved to an arbitrary file on the Velero
pod, which was then Stat'd, unmarshalled and restored as a Kubernetes object.

Both helpers now return an error when the joined path escapes rootDir, and all
callers handle it. rootDir is empty when building an entry path inside the
backup tarball, so "." is used as the containment base for that relative form.

Signed-off-by: chlins <chlins.zhang@gmail.com>

changelogs/unreleased/10102-chlins

@@ -0,0 +1 @@
+Verify extracted item paths stay inside the backup directory