feat: add native WebDAV submodule

This commit introduces a new, high-performance, and extensible WebDAV submodule, implemented natively without external dependencies.

The submodule includes:
- A core WebDAV handler that supports essential methods: PROPFIND, MKCOL, GET, PUT, DELETE, COPY, MOVE, LOCK, and UNLOCK.
- An extensible design using a `FileSystem` interface to decouple the protocol logic from the storage backend.
- Two `FileSystem` implementations:
  - `MemFS`: An in-memory, tree-based filesystem for testing and ephemeral storage. It correctly handles path segments like `.` and `..`.
  - `OSFS`: A secure, OS-based filesystem that interacts with the local disk. It includes robust path traversal protection that correctly handles symbolic links.
- A `LockSystem` interface with an in-memory implementation (`MemLock`) to support resource locking (DAV Class 2). It includes a graceful shutdown mechanism to prevent goroutine leaks.
- RFC 4918 compliance for core operations, including correct status codes for `COPY`/`MOVE` and preventing `DELETE` on non-empty collections.
- Comprehensive unit tests covering all major functionalities.
- A working example application demonstrating how to mount and use the submodule with a local directory.

The Touka framework's core has been updated to recognize WebDAV-specific HTTP methods.

This implementation addresses numerous points from detailed code reviews, including security vulnerabilities, memory leaks, RFC compliance issues, and path handling bugs.

webdav/memlock.go

@@ -17,6 +17,7 @@ import (
 type MemLock struct {
 	mu    sync.RWMutex
 	locks map[string]*lock
+	stop  chan struct{}
 }
 
 type lock struct {
@@ -30,21 +31,33 @@ type lock struct {
 func NewMemLock() *MemLock {
 	l := &MemLock{
 		locks: make(map[string]*lock),
+		stop:  make(chan struct{}),
 	}
 	go l.cleanup()
 	return l
 }
 
+// Close stops the cleanup goroutine.
+func (l *MemLock) Close() {
+	close(l.stop)
+}
+
 func (l *MemLock) cleanup() {
+	ticker := time.NewTicker(1 * time.Minute)
+	defer ticker.Stop()
 	for {
-		time.Sleep(1 * time.Minute)
-		l.mu.Lock()
-		for token, lock := range l.locks {
-			if time.Now().After(lock.expires) {
-				delete(l.locks, token)
+		select {
+		case <-ticker.C:
+			l.mu.Lock()
+			for token, lock := range l.locks {
+				if time.Now().After(lock.expires) {
+					delete(l.locks, token)
+				}
 			}
+			l.mu.Unlock()
+		case <-l.stop:
+			return
 		}
-		l.mu.Unlock()
 	}
 }