security(shared): fix -K TOCTOU, ssh old-args quoting, TLS opts, secret-file perms, sparse dedup

- file: open -K dirlink referents via a race-safe relative O_NOFOLLOW walk
  from the authorized-root fd instead of re-opening an absolute realpath()
  result (removes the intermediate-symlink swap TOCTOU).
- transport_ssh: always single-quote the server path, including --old-args,
  so no mode can inject shell metacharacters.
- transport_tls: set SSL_OP_NO_COMPRESSION and (guarded) SSL_OP_NO_RENEGOTIATION.
- credentials: reject --password-file/--early-input with any group/other
  permission bit; chmod 0600 the affected test fixtures.
- file_store: export file_store_write_sparse() and remove the verbatim
  file.c duplicate.

src/shared/file_store.h

@@ -10,5 +10,12 @@ bool file_store_rename_secure(const char* old_path, const char* new_path);
 bool file_store_write_secure(const char* path, const void* data, unsigned long long data_size,
                              bool inplace, bool sparse, const FileMetadata* metadata,
                              bool preserve_executability);
+/* Sparse-aware write (--sparse/-S): every all-zero run of at least
+ * SPARSE_HOLE_MIN bytes is skipped with lseek(SEEK_CUR) so it becomes a real
+ * hole; every other byte is written.  The caller pre-sizes the file with
+ * ftruncate; this function also ftruncate()s to `size` at the end so a trailing
+ * hole keeps the exact logical length.  Shared by the file_store and file write
+ * paths.  Returns false on write/lseek/ftruncate error. */
+bool file_store_write_sparse(int fd, const unsigned char* data, unsigned long long size);
 
 #endif