Fix TOCTOU races and symlink following in opal_os_dirpath

[jsquyres]

This resolves the last three open CodeQL code scanning alerts — the cpp/toctou-race-condition findings in opal/util/os_dirpath.c (104, 105, 106) — plus adjacent bugs found while auditing the callers. Context that shaped the fix: the only production caller of opal_os_dirpath_create()/destroy() is the singleton/direct-launch session-directory setup in ompi_rte.c (under mpirun, PMIx supplies the directories), always mode 0700, with a fully predictable name (ompi.<node>.<pid>.<uid>) under a world-writable default root (/tmp) — so the check-then-use races there are not just theoretical. (Updated after an AI-assisted local review pass, whose findings are folded in.)

Commit 1 — rework opal_os_dirpath_create() (alerts 105, 106): mkdir() first with EEXIST as the existence probe, and all inspection/mode adjustment of an existing directory done through a descriptor (open(O_DIRECTORY | O_NOFOLLOW)/fstat/fchmod) so the object checked is the object modified. Three deliberate behavior changes, all hardening: a pre-existing file at the requested path is now an error (previously it was chmod'ed and reported as success); a symlink at the requested path is refused rather than followed (following one would make the ownership check validate the link's target — which an attacker can choose to be something the victim owns); and an existing directory owned by another user is refused with a new help message (previously any pre-created directory whose mode was a superset of the request — e.g. an attacker-owned 0777 directory at the predictable session path — was silently adopted). Intermediate path components keep a plain stat() existence probe, so traverse-only (0711) intermediate directories continue to work.

Commit 2 — rework opal_os_dirpath_destroy() with descriptor-relative traversal (alert 104): the old traversal was path-based end to end — the stat() classifying each entry followed symlinks (so a symlink inside a session directory pointing outside the tree would send the recursive destroy through the link), and any entry could be swapped between classification and the subsequent opendir()/unlink() on the rebuilt path. The traversal is now descriptor-relative throughout: the base is opened once (O_DIRECTORY | O_NOFOLLOW — a symlinked base path is refused outright), entries are classified with fstatat(AT_SYMLINK_NOFOLLOW) and removed with unlinkat(), and subdirectories are entered via openat(O_NOFOLLOW) on the held descriptor and removed with unlinkat(AT_REMOVEDIR). The object classified is always the object acted on; symlinks are unlinked, never followed. All functions used are POSIX.1-2008. Callback-veto, non-recursive, and empty-base-removal semantics are preserved.

Commit 3 — session-dir cleanup callback fix (found during the caller audit): check_file() in ompi_rte.c passed &fullpath — an uninitialized char ** — as a path component to the variadic opal_os_path(), producing a garbage path, and never checked the stat() result, so the st_size test deciding whether an output- file is preserved read uninitialized memory. The keep/delete decision during session-directory cleanup was effectively random.

Commit 4 — regression tests, wired into make check, covering every new behavior: create-on-file refusal, create-on-symlink refusal (target untouched), destroy not following an in-tree symlink (target and contents survive), destroy refusing a symlinked base, non-recursive destroy with a subdirectory (files removed, subdir preserved, error returned), and a callback veto inside a subdirectory (protected file and its parent survive, overall success).

Verified with clean VPATH builds on both macOS (clang) and Linux (AlmaLinux 10, gcc 14): no new warnings, and the test/util/opal_os_dirpath suite (38 assertions) passes on both platforms. Backports: all four commits cherry-pick cleanly onto v6.0.x. On v5.0.x the three code commits apply cleanly; the test commit needs manual adaptation (the modernized test file does not exist on that branch). (Note: test/util/opal_os_create_dirpath.c is a dead source file — it still includes orte_config.h and is not referenced by Makefile.am; left alone here, but it could be deleted in a follow-up. The same TOCTOU patterns exist upstream in OpenPMIx's pmix_os_dirpath.c, which PRRTE also uses — and that is what creates session dirs under mpirun — so an upstream OpenPMIx PR should follow once this settles.)

[jsquyres]

@rhc54 I did not check, but these might apply to PMIx and/or PRTE. Might want to wait for these to get reviewed before applying them.

[hppritcha]

@jsquyres merge conflict