Fix findings from the security audit

Remote:
- TCP: handshake/connect deadlines follow --timeout instead of a 24h
  minimum, so idle sockets can no longer fill the connection pool.
- ACL: IPv4-mapped IPv6 addresses are matched against the IPv4 lists.
- UDP server now enforces the peer ACL and the outbound block list.
- ACL loading fails closed on bad files or invalid entries.
- TCP half-close is relayed instead of tearing the connection down.
- AEAD-2022 UDP sessions are created only after timestamp/replay checks.

ss-manager:
- Owner-only conf files (deleted on remove), 0600 control socket,
  umask 022, safe working directory, loopback-only IP addresses,
  per-user sender check on Linux, plugins only over the UNIX socket.
- Port canonicalisation, list() overflow, add/remove waits for the
  server, stale pid files can't signal unrelated processes.

Also: plugins drop to --user, daemonize readiness/pid file handling,
resolver cancellation, replay-filter fail-closed, key wiping, spec
strictness in AEAD/2022 parsing, JSON surrogate validation, ss:// plugin
name checks, embedding API state reset, Android protect_socket replies.

Adds tests/test_server_acl.py and tests/test_half_close.py and extends
the manager, ACL, AEAD-2022 and ssurl tests.

Co-Authored-By: Claude <noreply@anthropic.com>

tests/test_ssurl_cpp.cpp

@@ -1,6 +1,8 @@
 // SPDX-License-Identifier: GPL-3.0-or-later
 // ss:// URI parsing (src/ssurl.cpp): SIP002, the legacy form and malformed
 // input.
+#include <cstdio>
+#include <initializer_list>
 #include <cstddef>
 #include <cstring>
 
@@ -60,6 +62,25 @@ void test_sip002_plugin()
     ss_url_free(&u);
 }
 
+/* A shared link may name a plugin but not a path to a program; a repeated
+ * plugin= replaces the first; the tag cannot carry control characters. */
+void test_sip002_plugin_hardening()
+{
+    ss_url_t u;
+    const char *base = "ss://YWVzLTI1Ni1nY206cGFzc3dvcmQ@192.168.100.1:8888/?plugin=";
+    char url[256];
+    for (const char *bad : { "%2Ftmp%2Fevil", "..%2Fevil", "C:%5Cevil.exe", "", "%3Bopts" }) {
+        std::snprintf(url, sizeof(url), "%s%s", base, bad);
+        SS_CHECK(ss_url_parse(url, &u) == -1);
+    }
+    std::snprintf(url, sizeof(url), "%s%s", base, "first%3Ba&plugin=second%3Bb#line%0Abreak%1B");
+    SS_CHECK(ss_url_parse(url, &u) == 0);
+    SS_CHECK(streq(u.plugin, "second"));
+    SS_CHECK(streq(u.plugin_opts, "b"));
+    SS_CHECK(streq(u.tag, "line?break?"));
+    ss_url_free(&u);
+}
+
 /* The trailing slash before a query is allowed, and so is no query at all. */
 void test_sip002_trailing_slash()
 {
@@ -212,6 +233,7 @@ int main()
     SS_RUN(test_sip002_basic);
     SS_RUN(test_sip002_tag);
     SS_RUN(test_sip002_plugin);
+    SS_RUN(test_sip002_plugin_hardening);
     SS_RUN(test_sip002_trailing_slash);
     SS_RUN(test_sip002_ipv6);
     SS_RUN(test_sip002_plain_userinfo);