Race condition in the cleanup of `tempfile.TemporaryDirectory`

[StanFromIreland]

When working around file system permission errors, files are removed after resolving their path again, this means that by replacing a directory of the tree with a symbolic link, an attacker can make the cleanup delete files outside of the temporary directory.

Linked PRs

• gh-157579: Fix race condition in the cleanup of tempfile.TemporaryDirectory #157580
• [3.13] gh-157579: Fix race condition in the cleanup of tempfile.TemporaryDirectory (GH-157580) #158429
• [3.14] gh-157579: Fix race condition in the cleanup of tempfile.TemporaryDirectory (GH-157580) #158430
• [3.15] gh-157579: Fix race condition in the cleanup of tempfile.TemporaryDirectory (GH-157580) #158431
• [3.12] gh-157579: Fix race condition in the cleanup of tempfile.TemporaryDirectory (GH-157580) #158489
• [3.12] GH-157579: Revert GH-158489 (prematurely merged) #158527
• [3.12] GH-157579: Revert GH-158489 (prematurely merged) #158528

[hugovk]

TODO:

• this will need a fresh 3.12 backport PR.