feat: add native WebDAV submodule

This commit introduces a new, high-performance, and extensible WebDAV submodule, implemented natively without external dependencies.

The submodule includes:
- A core WebDAV handler that supports essential methods: PROPFIND, MKCOL, GET, PUT, DELETE, COPY, MOVE, LOCK, and UNLOCK.
- An extensible design using a `FileSystem` interface to decouple the protocol logic from the storage backend.
- Two `FileSystem` implementations:
  - `MemFS`: An in-memory, tree-based filesystem for testing and ephemeral storage. It correctly handles path segments like `.` and `..`.
  - `OSFS`: A secure, OS-based filesystem that interacts with the local disk. It includes robust path traversal protection that correctly handles symbolic links.
- A `LockSystem` interface with an in-memory implementation (`MemLock`) to support resource locking (DAV Class 2). It includes a graceful shutdown mechanism to prevent goroutine leaks.
- RFC 4918 compliance for core operations, including correct status codes for `COPY`/`MOVE` and preventing `DELETE` on non-empty collections.
- Comprehensive unit tests covering all major functionalities.
- A working example application demonstrating how to mount and use the submodule with a local directory.

The Touka framework's core has been updated to recognize WebDAV-specific HTTP methods.

This implementation addresses numerous points from detailed code reviews, including security vulnerabilities, memory leaks, RFC compliance issues, and path handling bugs.

webdav/osfs.go

@@ -26,18 +26,37 @@ func NewOSFS(rootDir string) (*OSFS, error) {
 }
 
 func (fs *OSFS) resolve(name string) (string, error) {
-	if filepath.IsAbs(name) {
+	if filepath.IsAbs(name) || strings.Contains(name, "..") {
 		return "", os.ErrPermission
 	}
+
 	path := filepath.Join(fs.RootDir, name)
 
-	rel, err := filepath.Rel(fs.RootDir, path)
-	if err != nil {
+	// Evaluate symlinks, but only if the path exists.
+	if _, err := os.Lstat(path); err == nil {
+		path, err = filepath.EvalSymlinks(path)
+		if err != nil {
+			return "", err
+		}
+	} else if !os.IsNotExist(err) {
 		return "", err
+		// For non-existent paths (like for PUT or MKCOL), we can't EvalSymlinks the full path.
+		// Instead, we resolve the parent and ensure it's within the root.
+	} else {
+		parentDir := filepath.Dir(path)
+		if _, err := os.Stat(parentDir); err == nil {
+			parentDir, err = filepath.EvalSymlinks(parentDir)
+			if err != nil {
+				return "", err
+			}
+			path = filepath.Join(parentDir, filepath.Base(path))
+		}
 	}
-	if strings.HasPrefix(rel, "..") {
+
+	if !strings.HasPrefix(path, fs.RootDir) {
 		return "", os.ErrPermission
 	}
+
 	return path, nil
 }