[jakkdl]

First bullet point of path manipulation in #58
Suspect this may be overly broad or trigger false alarms, but we'll see.

[Zac-HD]

Alas, I suspect that requiring rewrites for all code that calls os.path.join() (and other pure functions) is not going to be viable, so we'll need to read through https://docs.python.org/3/library/os.path.html and work out the list.

[jakkdl]

Read through the source code, and came up with this list

    safe = (
        "_get_sep",
        "_varprog",
        "_varprogb",
        "normcase",
        "isabs",
        "join",
        "split",
        "splitext",
        "splitdrive",
        "basename",
        "dirname",
        "expanduser",
        "commonpath",
        "expandvars",  # os.fsencode, os.environ, os.fsdecode
        "abspath",  # calls, os.getcwd, which I think python tracks internally?
        "commonprefix",
        "samestat",  # just does simple equality check
        # constants
        "curdir",
        "pardir",
        "extsep",
        "sep",
        "pathsep",
        "defpath",
        "altsep",
        "devnull",
        "supports_unicode_filenames",
    )
    os_funcs = (
        "_path_normpath",
        "normpath",
        "_joinrealpath",
        "islink",
        "lexists",
        "ismount",  # safe on windows, unsafe on posix
        "realpath",
        "exists",
        "isdir",
        "isfile",
        "getatime",
        "getctime",
        "getmtime",
        "getsize",
        "samefile",
        "sameopenfile",
        "relpath",
    )

[jakkdl]

Updated with explicit list of functions, also realized that looking for imports is easy - and might be somewhat common, so it will now catch that as well.
Rebased on top of main.