Fix security hole in ‘nix-store --serve’

Since it didn't check that the path received from the client is a
store path, the client could dump any path in the file system.

src/nix-store/nix-store.cc

@@ -923,7 +923,7 @@ static void opServe(Strings opFlags, Strings opArgs)
             }
             break;
         case cmdSubstitute:
-            dumpPath(readString(in), out);
+            dumpPath(readStorePath(in), out);
             break;
         default:
             throw Error(format("unknown serve command `%1%'") % cmd);