Open squashfs images as the calling user, not as root (kernel backend)

[bcumming]

Fixes finding #2 of the 2026-09-12 security audit. The setuid squashfs-mount
helper and the Slurm SPANK hook both opened the user-named image as root with
no check that the user could read it, so any user could mount and read any
squashfs file on the system. The fuse backend is not affected.

The image is now opened with the caller's credentials, and only the loop-device
and mount(2) syscalls run as root. Since LOOP_CONFIGURE binds a descriptor
rather than a path, there is no TOCTOU window.

• New util::privilege.{h,cpp} and util::unique_fd hold the credential
  changes and carry the open descriptors to the mount.
• Setuid helper drops euid at the top of main() and regains root only for
  the unshare and mount. It never touches gids.
• Slurm plugin assumes the job's uid, gid and supplementary groups on a
  dedicated thread via raw syscalls, so slurmstepd stays root. This replaces
  the setegid root_squash workaround from fix: mount squasfs files on root squashed NFS mounts #135.

Behaviour change: an image only root can read, or under a directory the user
cannot traverse, is now refused. Check modes on deployed image stores before
upgrading. Group-readable images now work under Slurm without --gid.