bake: add filesystem entitlements support

[tonistiigi]

Adds support for entitlements when bake definition accesses local files. Accessing files within the current working directory is allowed by default.

part of #179
closes #2697

In this version, privileged path accesses for local bake definitions only warns, unless BUILDX_BAKE_ENTITLEMENTS_FS is set. In next version, the intention is to make this case fail as with other entitlements.

[crazy-max]

Needs follow-up for GA:

• Remove volumes handling for root path on Windows and instead use volume of current working dir
• Check long path name handling in stdlib instead of using conversion from osutil

[tonistiigi]

@profnandaa FYI, if you would like to double-check any of the Windows path stuff. We can also ping you on follow-up PR>

[tonistiigi]

Discussing with @crazy-max the difference seems to be that in windows EvalSymlinks has extra toNorm call https://github.com/golang/go/blob/c37d9a0f9313ff2936b1b0b82476416e6cb03c62/src/path/filepath/symlink_windows.go#L113 that is missing in our custom evaluateToExistingPath implementation.