[CVE-2019-13636] Don't follow symlinks unless --follow-symlinks is given

[CVE-2019-13636] Don't follow symlinks unless --follow-symlinks is given

* src/inp.c (plan_a, plan_b), src/util.c (copy_to_fd, copy_file,
append_to_file): Unless the --follow-symlinks option is given, open files with
the O_NOFOLLOW flag to avoid following symlinks.  So far, we were only doing
that consistently for input files.
* src/util.c (create_backup): When creating empty backup files, (re)create them
with O_CREAT | O_EXCL to avoid following symlinks in that case as well.

Change-Id: Ic1ace0a9b9123cebd9e5a5f6c39bf69b85229fd9