Stop server-provided values from reaching a shell or escaping /dsc/seafile

Commands were joined into a string and passed to "su -c", so a login shell
parsed every interpolated value. A library name is chosen on the server, and
"sync -d /dsc/seafile/<name>" put it straight into that string: a library
named 'Docs; touch /tmp/pwned; #' ran as an arbitrary command. Confirmed
against the built image before and after this change.

Every command is now an argument list executed by "runuser --", which execs
directly with no shell. runuser -u sets the same HOME and a PATH that still
finds the seaf-cli wrapper, so the daemon environment is unchanged.

The password no longer needs its surrounding quotes, which also fixes
passwords containing quotes, dollar signs, and backticks.

Library names are untrusted, so dsc/paths.py reduces each one to a single
path component and proves the result stays under the libraries directory
with symlinks resolved. Empty, ".", "..", and names containing a separator
are skipped with a warning; names that would collide are suffixed with their
library ID rather than sharing a directory.

Tests cover quotes, command substitutions, separators, newlines, absolute
paths, parent traversal, Unicode, and colliding names. They run in a separate
CI job so application failures stay distinguishable from packaging failures.

start.py

@@ -7,6 +7,7 @@ import sys
 
 from dsc import SeafileClient, const
 from dsc.misc import setup_uid, create_dir
+from dsc.paths import plan_lib_dirs
 
 _lg = logging.getLogger('dsc')
 
@@ -76,8 +77,14 @@ def main():
     else:
         libs_dir = const.DEFAULT_LIBS_DIR
 
-    for lib_id in libs_to_sync:
-        client.sync_lib(lib_id, libs_dir)
+    # Library names come from the server, so the directory for each one is
+    # resolved and checked before anything is created or written.
+    lib_dirs = plan_lib_dirs(
+        {lib_id: client.remote_libraries[lib_id] for lib_id in libs_to_sync},
+        libs_dir,
+    )
+    for lib_id, lib_dir in lib_dirs.items():
+        client.sync_lib(lib_id, lib_dir)
     client.watch_status()
 
     client.stop_daemon()