fs-mistrust: refactor ResolvePath to avoid temporary changes.

Previously we would temporarily put self.resolved into an invalid
state by adding a path component that might be a symlink.  With this
change, we create a new temporary path object (using Cow to avoid
unnecessary allocations) and only conditionally replace
self.resolved.