Open all files with O_NOFOLLOW.

SD cards don't support symlinks, so we have no reason to try
following them if somehow an evil caller is able to sneak them into
the database.

Also fix deploy.sh to work after recent apexd changes.

Bug: 124329382
Test: atest --test-mapping packages/providers/MediaProvider
Change-Id: Idb1f3ee1db90913a97a50515003f211519037066
4 files changed