manifest-format: clarify <copyfile> & <linkfile> restrictions

While we don't (yet) explicitly enforce all of these, make sure
we document the expected behavior so we can all agree on it.

Bug: https://crbug.com/gerrit/11218
Change-Id: Ife8298702fa445ac055ef43c6d62706a9cb199ce
Reviewed-on: https://gerrit-review.googlesource.com/c/git-repo/+/232893
Reviewed-by: David Pursehouse <dpursehouse@collab.net>
Tested-by: Mike Frysinger <vapier@google.com>

docs/manifest-format.md

@@ -322,13 +322,25 @@ Zero or more copyfile elements may be specified as children of a
 project element. Each element describes a src-dest pair of files;
 the "src" file will be copied to the "dest" place during `repo sync`
 command.
+
 "src" is project relative, "dest" is relative to the top of the tree.
+Copying from paths outside of the project or to paths outside of the repo
+client is not allowed.
+
+"src" and "dest" must be files.  Directories or symlinks are not allowed.
+Intermediate paths must not be symlinks either.
 
 ### Element linkfile
 
 It's just like copyfile and runs at the same time as copyfile but
 instead of copying it creates a symlink.
 
+The symlink is created at "dest" (relative to the top of the tree) and
+points to the path specified by "src".
+
+The symlink target may be a file or directory, but it may not point outside
+of the repo client.
+
 ### Element remove-project
 
 Deletes the named project from the internal manifest table, possibly