fs-util: add new CHASE_NOFOLLOW flag to chase_symlinks()

This flag mimics what "O_NOFOLLOW|O_PATH" does for open(2) that is
chase_symlinks() will not resolve the final pathname component if it's a
symlink and instead will return a file descriptor referring to the symlink
itself.

Note: if CHASE_SAFE is also passed, no safety checking is performed on the
transition done if the symlink would have been followed.