Merge pull request #3055 from stoeckmann/cpio_uaf

cpio: Fix UAF in error path
Add entry only after its full initialization into list. Otherwise the error handling of a failing strdup would have to unlink the entry again.

Fixes: 16ad9310733e ("cpio reader: Validate pathname in record_hardlink")
Resolves #3053.