Audit libraries to check for problematic RPATH/RUNPATH when building

[JonathonReinhart]

This PR audits all libraries included (directly by staticx or indirectly as part of a PyInstaller archive) for use of DT_RPATH/DT_RUNPATH which is problematic as described in #169.

RPATH/RUNPATH are removed from the libraries when possible, which does not apply to libraries already part of a PyInstaller archive:

	RPATH	RUNPATH
In a library being added as a dependency	🧹 Removed	🧹 Removed
In a library already part of PyInstaller archive	⚠️ ...	❌ Forbidden

Those libraries are examined to determine is the RPATH/RUNPATH is problematic. RUNPATH is always forbidden, as detailed in #169. RPATH is allowed unless it is deemed "dangerous":

RPATH in a library already part of PyInstaller archive...
Absolute path	❌ Forbidden
Path relative to working dir	❌ Forbidden
Path relative to $ORIGIN (below)	✔️
Path relative to $ORIGIN (above)	❌ Forbidden

Problematic uses which cannot be corrected will point the user at #188.

Closes #172.
See #169.

[JonathonReinhart]

Based on this conversation with myself, I went ahead and started treating RPATH and RUNPATH exactly the same.

Because this is more likely and wide-reaching that I initially thought, I also went ahead and added patchelf --remove-rpath in StaticxGenerator.add_library() to "fix" the problematic libraries. Note that we cannot (easily) do this for libraries already in the PyInstaller archive.

---

Now, an existing test (test/pyinstall-cffi/) is failing, as it should:

staticx.errors.UnsupportedRpathError: /tmp/staticx-pyi-znqc4zfi/_cffi_backend.cpython-39-x86_64-linux-gnu.so uses unsupported DT_RPATH ('$ORIGIN/cffi.libs').

Confirmed with readelf:

$ readelf -d ./venv/lib/python3.9/site-packages/_cffi_backend.cpython-39-x86_64-linux-gnu.so

Dynamic section at offset 0xd2000 contains 28 entries:
  Tag        Type                         Name/Value
 0x000000000000000f (RPATH)              Library rpath: [$ORIGIN/cffi.libs]
 0x0000000000000001 (NEEDED)             Shared library: [libffi-c643fa1a.so.6.0.4]
 ...

$ ls -l venv/lib/python3.9/site-packages/cffi.libs/
total 48K
-rwxr-xr-x 1 jreinhart jreinhart 46K Oct  3 03:14 libffi-c643fa1a.so.6.0.4

This RPATH is harmless because it is relative (down) from $ORIGIN, so it won't break out of our extracted "jail". (It's also unnecessary, as noted in #61 (comment)).

So I think I'll also have to implement the second part of this self-suggestion which is to check for "dangerous" rpaths. Otherwise, staticx will fail on a bunch of stuff unnecessarily.