discover-image: Follow symlinks in a given root (#39843)

This is needed to set up extension images from the initrd with
`systemd-sysext --root=/sysroot/ merge`.

- vpick: Don't use openat directly but resolve symlinks in given root

With systemd-sysext --root= all symlinks should be followed relative to
    the given root and direct openat usage doesn't work.
    Remove the openat call and let pin_choice do the work with the chase
    helper function to resolve the symlink in the given root.
- discover-image: Follow symlinks in a given root

    So far systemd-sysext with --root= specified didn't follow extension
symlinks (such as the "current" symlinks managed by systemd-sysupdate).
The main use case is running systemd-sysext --root=/sysroot for setting
    up the overlay mounts already from the initrd.

Resolve symlinks correctly but don't defend against later symlink races
    that would access a path outside of the given root. Malicous live
modifications are not a realistic threat model and anyway for that one
would need to rework how the image entry is passed over up to the point
when the loop device is set up. This change here does not introduce this
weakness nor does it expose it more than before. Thus, make it explicit
    that setting up the extensions for a given --root= implies a certain
trust into this given root tree that it does not try do race conditions
with symlinks to trick systemd-sysext to mount a file outside --root=.
Without a strict --image-policy= set we would anyway mount filesystems
right away which is another attack vector but, again, the main use case
    is to do this for the final system which is trusted at this stage.
- sysext: Use correct image name for extension release checks

For the extension release check the image name is needed and was derived
    from the backing file of the loop device. However, this can have a
different name when symlinks were resolved. The surprising behavior was
that it worked when the target name started with the extension name and
_ because that's what's supported to chop off version suffixes. However,
we should not have such strict requirements for the target name and also
allow - as version separator and entirely different names/prefixes, the
    same way as we also do for directories instead of raw images.

    Do not use the image name derived from the backing file of the loop
    device but directly the extension name we have at hand.
- test: Add tests for handling symlinks with systemd-sysext

    When we now allow following symlinks inside a --root= we should also
test that it works in various cases from simple relative and absolute
    symlinks to .v being a symlink itself or its contents, both for
directory and for .raw image extensions. While at it, also add a simple
    test for .v without symlinks which wasn't there for direct usage of
    systemd-sysext.

diff --cc src/shared/discover-image.c
Simple merge

diff --cc src/sysext/sysext.c
Simple merge

diff --cc test/units/TEST-50-DISSECT.sysext.sh
Simple merge