Backport !2325 “file-roller symlink attack” to glib-2-66

Trivial backport of most of !1981 (merged), minus the large number of new tests.

Fixes: #2325 (closed)