GHSA-5fqc-mrg8-w798: Dulwich: Symlink directory traversal in filter-branch index_filter via cross-commit state persistence

Dulwich’s filter_branch.py CommitFilter._apply_index_filter() is vulnerable to symlink directory traversal. When processing commit history, materialized tree entries (including symlinks) persist in the working directory between commits, allowing a symlink from an ancestor commit to redirect file writes from a descendant commit to arbitrary filesystem locations.