Bug#306693: cpio: allows extracting insecure pathnames (leading slash = / and dotdot = ..)

[t takahashi]

severity: important

After looking at the severities of other cpio bug reports that have
been around for hundreds of days, I concluded that this should be
important instead of normal.