Library desktop background read: open each path part without following links #425

Found in the review of #67 (Set as Desktop Background from Library).

elastos/crates/elastos-server/src/library/desktop_background.rs require_no_links checks every path part with symlink_metadata, and then crate::auth::read_principal_root_object_limited (auth.rs) opens the final path by name. O_NOFOLLOW on that open covers only the last part. A local process that can write in the person's Library folder can swap a parent folder for a symbolic link between the check and the open, so the read can land outside the person's root.

What to do:

• Open the principal root once, then walk each part with openat(dirfd, part, O_NOFOLLOW | O_DIRECTORY) (and O_NOFOLLOW for the file), so no part is resolved by name after it was checked. On Linux openat2 with RESOLVE_NO_SYMLINKS | RESOLVE_BENEATH does this in one call; macOS needs the per-part walk.
• Apply the same reader to Library's other reads by path (download, thumbnails) if they share the gap.
• Add a test that swaps a parent folder for a link after the check (a hook between check and open) and proves the read is refused.

Out of scope for #67, which keeps the check-then-open and says so.