Fixes from the phase-1 code review

- one locking protocol per location: backup steps and restores hold a
  shared lock, prune and untrash an exclusive one and refuse while any
  run (backup, restore, export) exists; starting a backup checks and
  creates the run under the exclusive lock, closing the race with prune
- snapshot entries are validated when read (relative path without '.',
  '..', NUL, backslash or control characters); raw restore also checks
  that the resolved directory stays below the target; the restore API
  and service accept canonical paths only
- recovery kit confirmation requires a recent password confirmation and
  the confirmation code printed in the current kit file (new code per
  kit version), proving the kit was actually downloaded
- prune decides on the authenticated index files on the location and
  refreshes the local index cache from them
- restore job marks the run failed on any error; restore runs without
  progress for 6 hours are failed so they cannot block cleanup forever
- tests for safe paths and a malicious snapshot path

lib/Repository/BlobIndex.php

@@ -45,8 +45,9 @@ final class BlobIndex {
 	 * and only the index files that are not cached yet are downloaded. Cached packs that no
 	 * longer exist on the backend are dropped from the cache.
 	 */
-	public function load(): void {
-		$cached = $this->cache?->all($this->repositoryId) ?? [];
+	public function load(bool $verify = false): void {
+		$this->blobs = [];
+		$cached = $verify ? [] : ($this->cache?->all($this->repositoryId) ?? []);
 		$present = [];
 		$this->downloaded = 0;
 		foreach ($this->backend->list('index') as $path) {
@@ -65,6 +66,20 @@ final class BlobIndex {
 				$this->blobs[$e['id']] = [$packId, $e['offset'], $e['length'], $e['raw'], $e['flags']];
 			}
 		}
+		if ($verify && $this->cache !== null) {
+			// Refresh the cache from what was just verified.
+			$this->cache->remove($this->repositoryId, array_keys($this->cache->all($this->repositoryId)));
+			foreach ($this->packs() as $packId => $_) {
+				$entries = [];
+				foreach ($this->blobs as $id => [$pack, $offset, $length, $raw, $flags]) {
+					if ($pack === $packId) {
+						$entries[] = ['id' => $id, 'offset' => $offset, 'length' => $length, 'raw' => $raw, 'flags' => $flags];
+					}
+				}
+				$this->cache->put($this->repositoryId, $packId, $entries);
+			}
+			return;
+		}
 		$stale = array_keys(array_diff_key($cached, $present));
 		if ($stale !== []) {
 			$this->cache?->remove($this->repositoryId, $stale);