Host inode creation via mountpoint symlink race

Symlink race in runc 1.1.13 and earlier and 1.2.0-rc2 and earlier allows local users to create empty host filesystem inodes. During bind-mount setup, createMountpoint resolves a container path, then os.MkdirAll or open(O_CREAT) follows a symlink swapped in by a racing container and creates the target outside the rootfs. Exploitation requires starting two containers with a shared volume and custom volume configuration; it creates empty files or directories without truncating existing files.