We don't want to allow readlink on all components.

We just want realpath() to work.

What we really want is to allow realpath() to resolve to an unveil'ed
vnode *without* having to allow readlink() on every path component to
get there.

We could strike up a team, or wait for a committee.. Or....