cpio: mark CVE-2023-7216 as disputed

Upstream consider the behaviour described in this CVE as intentional,
and provide an option to stop it.

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>