Fixes from the phase-1 code review

- one locking protocol per location: backup steps and restores hold a
  shared lock, prune and untrash an exclusive one and refuse while any
  run (backup, restore, export) exists; starting a backup checks and
  creates the run under the exclusive lock, closing the race with prune
- snapshot entries are validated when read (relative path without '.',
  '..', NUL, backslash or control characters); raw restore also checks
  that the resolved directory stays below the target; the restore API
  and service accept canonical paths only
- recovery kit confirmation requires a recent password confirmation and
  the confirmation code printed in the current kit file (new code per
  kit version), proving the kit was actually downloaded
- prune decides on the authenticated index files on the location and
  refreshes the local index cache from them
- restore job marks the run failed on any error; restore runs without
  progress for 6 hours are failed so they cannot block cleanup forever
- tests for safe paths and a malicious snapshot path

lib/BackgroundJob/BackupJob.php

@@ -47,12 +47,26 @@ class BackupJob extends TimedJob {
 				$run = $this->backups->step($run, min($deadline, microtime(true) + $budget));
 			}
 		}
+		$this->failStaleRestores();
 		$this->weeklyPrune();
 		foreach ($this->targets->list() as $t) {
 			$this->alerts->checkStale($t);
 		}
 	}
 
+	/** A restore run that has not moved for 6 hours is considered dead (it would block cleanup forever). */
+	private function failStaleRestores(): void {
+		foreach ($this->runs->findRunning(null, 'restore') as $run) {
+			if (time() - $run->getUpdatedAt() > 6 * 3600) {
+				$run->setStatus(\OCA\NgBackup\Db\Run::FAILED);
+				$run->setError('No progress for 6 hours; marked as failed');
+				$run->setFinishedAt(time());
+				$this->runs->update($run);
+				$this->alerts->runFailed($run, '#' . $run->getTargetId());
+			}
+		}
+	}
+
 	/** Once a week (after Sunday's backup), apply the retention policy to non-append-only locations. */
 	private function weeklyPrune(): void {
 		$lastWeek = $this->appConfig->getValueString(Application::APP_ID, 'last_prune_week', '');