implement a "hardened" resolver backend

[cyphar]

For hyper-concerned users we could implement a backend that actually uses pivot_root and then does the path resolution like that. It would be a bit ugly (and possibly somewhat slow) but it could be pretty cool and would allow for more hardened setups to opt-in to even more security features.