Make map_directory_child_fs() refuse the names "." and "..".  This is
currently the interface where an attacker may inject a manipulated
path (through the "update" command).