Escape and validate special characters in mount option values

[cberner]

Fixes #424

Mount option values are passed to the kernel, libfuse, and the fusermount helpers inside a comma separated list, so a comma in a value was read as the start of another option: MountOption::FSName("foo,ro") mounted a read-only filesystem named foo. A NUL in a value panicked instead of returning an error.

Following the analysis in the issue:

• fsname is escaped (, -> \,, \ -> \\) for the consumers that decode backslash escapes, and passed verbatim as the mount(2) source, which needs no escaping.
• Values that cannot be escaped consistently across those consumers are rejected with InvalidInput from Session::new(): comma and backslash in Subtype and CUSTOM (libfuse does not re-escape them when forwarding to fusermount), and in fsname too on platforms whose mount helpers decode no escapes.
• NUL is rejected in every value, replacing the panic.

The check lives in Mount::new() rather than Session::new() so that every formatting of an option value can rely on it, including the direct Mount::new() calls in tests.

The deprecated escaping question for fuser::mount/spawn_mount raised at the end of the issue is left alone, as suggested there.

Testing

Unit tests cover the escaping and the per-platform validation rules. A new mount test asserts that the comma in FSName("fuser,ro") reaches /proc/self/mounts as part of the source name and does not appear among the mount options.

Ran green on all three mount backends (pure-rust, libfuse2, libfuse3), both as root (direct mount(2)) and as an unprivileged user going through a real fusermount3, whose argv I logged to confirm it receives -o fsname=fuser\,ro. Reverting just the escaping call makes the new test fail with left: "fuser", right: "fuser,ro", so it does catch the reported bug.

Also clean locally: cargo fmt --check, clippy with --deny warnings (default and --no-default-features), cargo test --all with and without libfuse, cargo doc, the musl target, cargo check --target x86_64-apple-darwin --features=macos-no-mount, and both test_passthrough scripts. The Docker suites (mount_tests, pjdfs_tests, xfstests) could not run in my environment (no Docker daemon), so they are covered only by CI here.

---

Generated by Claude Code