add O_NOFOLLOW to base flags, see #908

scenario:

- x is a regular file
- borg does stat on x: is a regular file
- so borg dispatches to process_file
- attack: x gets replaced by a symlink (mv symlink x)
- in process_file, borg opens x and must not follow the symlink nor
  continue processing as a normal file, but rather error in open()
  due to NOFOLLOW.

src/borg/helpers/fs.py

@@ -202,7 +202,7 @@ def O_(*flags):
     return result
 
 
-flags_base = O_('BINARY', 'NONBLOCK', 'NOCTTY')  # later: add 'NOFOLLOW'
+flags_base = O_('BINARY', 'NONBLOCK', 'NOCTTY', 'NOFOLLOW')
 flags_normal = flags_base | O_('RDONLY')
 flags_noatime = flags_normal | O_('NOATIME')
 flags_root = O_('RDONLY')