pub fn safe_join(base_dir: &Path, untrusted_name: &str) -> Result<PathBuf>
Sanitize untrusted_name then join it to base_dir and validate the result.
untrusted_name
base_dir