curl: libcurl cache updates follow symlinks and truncate their targets

Summary: When curl updates an HSTS, Alt-Svc, or cookie cache, it opens the supplied path with "w" before validating it, so a symlink path can truncate the file it targets. Root cause: Curlfopen calls curlxfopenfilename, "w" before checking the path or creating the safe temporary file, and fopen...