acls/xattrs: -X/--xattrs, -A/--acls, --fake-super

New src/shared/xattr.{c,h}: capture user.* + POSIX ACL xattrs, transmit a bounded
per-file block, re-apply fd-relative. security.*/trusted.*/other system.* never
transmitted/applied (receiver re-validates). Bounds: name<=255 value<=1MiB count
<=256 total<=4MiB. --fake-super records uid:gid:mode:mtime in reserved
user.fastsync.stat (receiver-only). PROTOCOL_VERSION 2.12.0->2.13.0. Review
fixes: reserved key not forwardable, link/hardlink copy-fallback preserves
xattrs, no const-param mutation, per-file warning dedup.

src/client/client_validation.c

@@ -79,6 +79,14 @@ bool validate_config(const Config* config) {
                 "--hard-links/-H cannot be combined with -s (chunk serialization)");
     return false;
   }
+  /* -X/-A ride the per-file metadata frame; the buffer-based chunk-serialization
+     wire format does not carry the xattr block, so the pair is rejected up front
+     (mirroring -H + -s) rather than silently dropping attributes. */
+  if ((config->preserve_xattrs || config->preserve_acls) && config->use_chunk_serialization) {
+    log_message(LOG_LEVEL_ERROR,
+                "--xattrs/-X and --acls/-A cannot be combined with -s (chunk serialization)");
+    return false;
+  }
   if (config->preserve_hard_links && (config->append || config->append_verify)) {
     log_message(LOG_LEVEL_ERROR,
                 "--hard-links/-H cannot be combined with --append/--append-verify");