Harden NFS file-copy plugin and core disk/AIO paths against corrupt input and recoverable failures

[linmajia]

Summary

This branch hardens the NFS file-copy plugin (used by replica learning) and
several core disk-engine / AIO / filesystem paths so that recoverable I/O
failures and corrupt or untrusted RPC input no longer abort the host process.
Each fix converts a fatal dassert/uncaught-exception/OOB-access into a
graceful error return through a channel the surrounding code already has
(NFS completion callback, aio callback, or a bool/error_code return).
Happy-path behavior is unchanged; the new code runs only on failure paths.

It also fixes two empty-file (0-byte) copy regressions and advances the
rDSN.dist.service submodule pointer to its merged master
(the replication/meta-server hardening, merged separately as
rDSN.dist.service#30).

Motivation

The NFS service and the shared disk/AIO engine run on every replica node inside
one process. A single recoverable disk error (short write on a full disk,
fsync/close/stat failure, io_destroy during shutdown) or one malformed
NFS RPC from a peer could dassert/throw and abort the whole host — taking down
every healthy replica with it. Several of these were also memory-safety bugs
(OOB reads, uninitialized-heap disclosure into replicated data).

Changes

NFS — untrusted-input hardening

• end_get_file_size mismatched list lengths — the response's parallel
  size_list/file_list arrays from an untrusted peer were indexed in
  lockstep without checking equal length → OOB std::vector::operator[] read.
  Now validated up front; rejected with ERR_INVALID_DATA.
• end_copy response-size validation — the client wrote
  response.file_content.data() for response.size bytes without checking
  size against the buffer length → past-the-end read corrupting the
  destination with heap memory (disclosure into replicated data) or crash.
  Now cross-checked before the local write; rejected with ERR_INVALID_DATA.
  (Client-side counterpart of the validation on_copy already does on the
  request.)
• on_get_file_size source_dir prefix — the server stripped the
  source_dir prefix via path.substr(request.source_dir.length()), using the
  raw untrusted length as a position into an already-normalized path. A
  non-normalized source_dir (e.g. redundant slashes) makes the normalized
  path shorter → std::out_of_range thrown off an RPC worker thread (no
  try/catch in dispatch) → NFS service abort. Both loops now guard the length
  and reject with ERR_INVALID_PARAMETERS.

NFS — recoverable-failure & empty-file handling

• File-copy I/O aborts → error channel — continue_write,
  handle_completion, close_file GC, and the all-files on_get_file_size
  branch now route create_directory/dsn_file_open/dsn_file_close/
  file_size failures through the completion channel (or dwarn) instead of
  aborting. The local-write pump now iterates instead of recurses, so a
  persistent error can't grow the stack.
• Zero-byte file copy — empty source files (one size == 0 copy request)
  previously failed the whole transfer: first because on_copy rejected
  size <= 0 (relaxed to size < 0, keeping the oversized-request overflow
  guard), and then because a zero-length aio read/write completes with
  ERR_HANDLE_EOF, not ERR_OK. The server now short-circuits a size == 0
  request with an empty ERR_OK reply and the client finalizes the segment
  inline as success — no zero-length aio is issued.
• Short-read uninitialized data — internal_read_callback set resp.size
  to the requested size while shipping the full block buffer, so a short read
  wrote uninitialized heap into the destination (corruption + disclosure). Now
  fails the block with ERR_FILE_OPERATION_FAILED when fewer bytes than
  requested are read.

Core — disk engine, AIO, filesystem

• disk_file::on_write_completed short write — asserted the provider always
  wrote the full requested size (false on a full disk). Now reports
  ERR_FILE_OPERATION_FAILED for the affected and remaining batched tasks via
  the aio channel and preserves the trailing size == 0 invariant.
• ~native_linux_aio_provider io_destroy — a destructor asserted
  io_destroy() == 0, aborting at shutdown if the kernel AIO context was
  already released (EINVAL). Now logs derror and lets shutdown proceed.
• remove_directory nftw walk — the nftw callback aborted on any
  typeflag other than FTW_F/FTW_DP, but FTW_NS (per-entry stat failure)
  and FTW_DNR (unreadable dir) are recoverable. Now dwarn + FTW_STOP so
  the caller returns false instead of crashing (no-op on the Windows walk).

Submodule

• rDSN.dist.service pointer → master — advanced to the merged-master
  commit containing the replication-log / meta-server / mutation::read_from
  hardening (merged as rDSN.dist.service#30).