consider migrating to io/fs.StatFS for SecureJoinVFS

[cyphar]

Now the Go has their own "generic" interfaces for filesystem roots, maybe it would make sense to migrate to using that rather than our own home-brew thing. Note that we want to be given the equivalent of fs.DirFS("/") not fs.DirFS(root) -- we are implementing our own resolution logic, and the unsafe path.Join logic in io/fs is not going to work.

[cyphar]

It seems that there's no way to Readlink with io/fs.FS, and it also seems that they expect implementations to follow trailing symlinks (though the docs seem a little unclear). So this might not be possible...