Fall back to an NTFS junction when the symlink escape test can't create a symlink

Windows only lets elevated processes, or any process once Developer Mode is
on, create symlinks, so test_safe_join_rejects_symlink_escape errored with
WinError 1314 on an ordinary developer machine while passing on the hosted
runners (which are both elevated and have Developer Mode enabled). A junction
needs no privilege and Path.resolve() follows it the same way, so the
containment assertion still runs there instead of being skipped.

Fixes #3408

Author: maxisbey

tests/shared/test_path_security.py

@@ -1,5 +1,6 @@
 """Tests for filesystem path safety primitives."""
 
+import sys
 from pathlib import Path
 
 import pytest
@@ -142,7 +143,14 @@ def test_safe_join_rejects_symlink_escape(tmp_path: Path):
     outside.mkdir()
     sandbox = tmp_path / "sandbox"
     sandbox.mkdir()
-    (sandbox / "escape").symlink_to(outside)
+    try:
+        (sandbox / "escape").symlink_to(outside)
+    except OSError as exc:  # pragma: lax no cover
+        if sys.platform != "win32" or exc.winerror != 1314:  # ERROR_PRIVILEGE_NOT_HELD; a junction needs no privilege
+            raise
+        import _winapi
+
+        _winapi.CreateJunction(str(outside), str(sandbox / "escape"))
 
     with pytest.raises(PathEscapeError, match="escapes base"):
         safe_join(sandbox, "escape", "secret.txt")