portable: keep unit symlinks inside the image

Open unit files with chase_and_openat() rooted at the image instead of
plain openat(). Symlinks are now resolved under the image root and must
end at a regular file.

Reproducer:
  ln -s /tmp/portable-host-unit \
      IMAGE/usr/lib/systemd/system/PREFIX.service
  portablectl inspect --cat IMAGE PREFIX.service

Before:
  inspect followed the absolute symlink on the host and printed host
  file contents as image unit metadata. Image inspection could leak or
  trust files outside the portable image.

Follow-up: 61d0578b07

test/units/TEST-29-PORTABLE.directory.sh

@@ -24,6 +24,14 @@ rm -rf /tmp/mismatched-name
 cp -a /tmp/minimal_0 /tmp/mismatched-name
 portablectl inspect /tmp/mismatched-name | grep -F "minimal-app0.service" >/dev/null
 
+rm -rf /tmp/symlink-unit
+cp -a /tmp/minimal_0 /tmp/symlink-unit
+printf '[Service]\nExecStart=/bin/true\n' >/tmp/portable-host-unit
+rm -f /tmp/symlink-unit/usr/lib/systemd/system/minimal-app0.service
+ln -s /tmp/portable-host-unit /tmp/symlink-unit/usr/lib/systemd/system/minimal-app0.service
+(! portablectl inspect --cat /tmp/symlink-unit minimal-app0.service)
+rm -f /tmp/portable-host-unit
+
 portablectl "${ARGS[@]}" attach --copy=symlink --now --runtime /tmp/minimal_0 minimal-app0
 
 systemctl is-active minimal-app0.service