git-sec: adopt git-for-windows exception rules

[davidkna]

This PR implements the changes proposed in #424:

Git-for-Windows has some exceptions for the ownership checks. The home directory is accepted unconditionally (which is owned by admin instead of the user), and admin-group-owned folders are accepted if the user is an admin (helpful in environments like Github-Actions).

Git-for-Windows references:
https://github.com/git-for-windows/git/blob/0cd1496fc3dd78dadbdf3644ec4d384188573e6f/compat/mingw.c#L3503-L3515

https://github.com/git-for-windows/git/blob/0cd1496fc3dd78dadbdf3644ec4d384188573e6f/compat/mingw.c#L3535-L3543

I couldn't make CheckTokenMembership work with the token/handle already being opened, so I instead I made it forward a null value to have the Windows API handle the details. As part of that attempt, I also made the code prefer using a thread token instead of a process token, which seems to be preferred, and added a CloseHandle call for the old handle.

[Byron]

Thanks a million! This looks good to me, but then again, I am not an authority on how to do these things. The group membership check was already implemented at some point and made by a Microsoft employee, hence it probably is the authoritative version: 9a3f0ba#diff-71eaf9b8d0991458e6650383da1d69a99dff38608f29fa716c03e67b9388c0ffR70 . If you find anything there to remove the TODO, you could do so in another PR.

Thanks for all your help with this, you are definitely pushing gitoxide along considerably!

[davidkna]

Thanks to you too! It looks like they went with the same approach as me for the membership test.

Regarding 85ab096, to make ownership checks work with networks drives, mounting the network drive as a single-letter drive has worked for me in the past.

[Byron]

Thanks for the great suggestion! I tried it (actually the mount was already there as drive Z, I just didn't see it), but the same issue ensues. I am actually happy about it as it would be strange to have different permissions depending on the way one reaches the very same resource. Maybe there is more to mapping a drive though, after all this one was pre-created. For now it seems OK to keep this test-only environment variable switch.