feat: add native WebDAV submodule with usability helpers and fixes

This commit introduces a new, high-performance, and extensible WebDAV submodule, implemented natively without external dependencies. It also adds a high-level API to simplify common use cases and incorporates numerous fixes based on detailed code reviews.

Features:
- A core WebDAV handler supporting `PROPFIND`, `MKCOL`, `GET`, `PUT`, `DELETE`, `COPY`, `MOVE`, `LOCK`, `UNLOCK`.
- An extensible design with `FileSystem` and `LockSystem` interfaces.
- `MemFS`: A robust, tree-based in-memory filesystem for testing.
- `OSFS`: A secure OS-based filesystem with protection against path traversal and symlink attacks.
- `MemLock`: An in-memory locking system with graceful shutdown to prevent resource leaks.
- A high-level API (`webdav.Serve`, `webdav.Register`) for ease of use.

Fixes & Improvements:
- Security: Patched directory traversal and symlink vulnerabilities. Ensured secure lock token generation.
- RFC Compliance: Corrected status codes for `COPY`/`MOVE` (201 vs 204), `DELETE` on non-empty collections (409), and `Timeout` header parsing.
- Performance: Implemented `sync.Pool` for object reuse and `sync/atomic` for file size management to reduce GC pressure.
- Robustness: Fixed numerous bugs related to path handling, resource cleanup (goroutine leaks), and header parsing.

Integration:
- The Touka framework's core has been updated to recognize all necessary WebDAV methods.
- Includes comprehensive unit tests and a working example.

webdav/easy.go

@@ -5,6 +5,7 @@
 package webdav
 
 import (
+	"io"
 	"log"
 	"os"
 
@@ -20,10 +21,6 @@ type Config struct {
 
 // Register registers a WebDAV handler on the given router.
 func Register(engine *touka.Engine, prefix string, cfg *Config) {
-	if cfg.LockSystem == nil {
-		cfg.LockSystem = NewMemLock()
-	}
-
 	handler := NewHandler(prefix, cfg.FileSystem, cfg.LockSystem, cfg.Logger)
 
 	webdavMethods := []string{
@@ -33,16 +30,18 @@ func Register(engine *touka.Engine, prefix string, cfg *Config) {
 }
 
 // Serve serves a local directory via WebDAV.
-func Serve(engine *touka.Engine, prefix string, rootDir string) error {
+func Serve(engine *touka.Engine, prefix string, rootDir string) (io.Closer, error) {
 	fs, err := NewOSFS(rootDir)
 	if err != nil {
-		return err
+		return nil, err
 	}
 
+	ls := NewMemLock()
 	cfg := &Config{
 		FileSystem: fs,
+		LockSystem: ls,
 		Logger:     log.New(os.Stdout, "", 0),
 	}
 	Register(engine, prefix, cfg)
-	return nil
+	return ls, nil
 }