rsyncd: implement serving from fs.FS

related to gokrazy#8

receiver: implement --checksum (the sender already supported it)

sender: correctly use os.Root for localDir vs. requested path

Previously, we concatenated the attacker-supplied requested path
directly to the localDir, which is not safe. Instead, now
we use os.Root to open localDir (configured), then pass the
attacker-supplied requested path to that safe API.

related to gokrazy#48

reference compression analysis in rsyncopts comment

internal/maincmd: fix relative paths (+test)

fixes gokrazy#39

pull in latest x/ packages

receiver: use os.OpenRoot (Traversal-resistant file APIs)

See https://go.dev/blog/osroot

This is an effective mitigation against attacks like CVE-2024-12086

Note that not all operations are covered:

The os.Root type in Go 1.24 does not yet cover all file operations,
but the one in Go 1.25 will. I have left TODOs in place.

The google/renameio package does not yet support the *os.Root type.

Some functions from the x/sys/unix package like unix.Mknod are used
safely with the *os.Root type by safely opening the parent directory
with os.Root.OpenFile, then using unix.Mknodat(int(f.Fd()), …).
Thanks to Damien Neil for sharing this trick!

I am not aware of a file descriptor-bound version of unix.Bind().

remove now-dead code

GitHub Actions: bump action versions

rsyncd: add HandleConnArgs (rsyncopts is not exported)

We should refactor InternalHandleConn away eventually.