- Update to umoci v0.4.7. CVE-2021-29136 bsc#1184147

A security flaw was found in umoci, and has been fixed in this release. If
umoci was used to unpack a malicious image (using either umoci unpack or
umoci raw unpack) that contained a symlink entry for /., umoci would apply
subsequent layers to the target of the symlink (resolved on the host
filesystem). This means that if you ran umoci as root, a malicious image
could overwrite any file on the system (assuming you didn't have any other
access control restrictions). Thanks to Robin Peraglie from Cure53 for
discovering this bug. CVE-2021-29136

Other changes in this release:

* umoci now compiles on FreeBSD and appears to work, with the notable
limitation that it currently refuses to extract non-Linux images on any
platform (this will be fixed in a future release).
* Initial fuzzer implementations for oss-fuzz.
* umoci will now read all trailing data from image layers, to combat the
existence of some image generators that appear to append NUL bytes to the
end of the gzip stream (which would previously cause checksum failures
because we didn't read nor checksum the trailing junk bytes). However,
umoci will still not read past the descriptor length.
* umoci now ignores all overlayfs xattrs during unpack and repack
operations, to avoid causing issues when packing a raw overlayfs
directory.
* For details, see CHANGELOG.md in the package.