RCE on ingress-nginx-controller via Ingress spec.rules.http.paths.path field

A user with ingress create/update privilege may inject config into `nginx.conf` with `path`. Config the log_format and access_log to write arbitrary file. Include the file we created to bypass `path` sanitizer to RCE.

serverVersion:
  buildDate: "2022-03-06T21:32:53Z"
  compiler: gc
  gitCommit: e6c093d87ea4cbb530a7b2ae91e54c0842d8308a
  gitTreeState: clean
  gitVersion: v1.23.4
  goVersion: go1.17.7
  major: "1"
  minor: "23"
  platform: linux/amd64