harden against symlink attacks

/config is owned by the unprivileged runtime user after the ownership sweep, so root operations on files there could be redirected by a planted symlink.

- go2rtc HomeKit setup: replace the root yq/jq normalization and chown with an O_NOFOLLOW helper (prepare_homekit.py), so a symlink at go2rtc_homekit.yml can't redirect a root write or chown onto another file
- go2rtc binary override: ignore /config/go2rtc whenever the service runs as root, so a planted binary can't exec as root under FRIGATE_ROOT_SERVICES
- sweep sentinel: read and write it through safe-sentinel, which trusts only a root-owned regular file and never follows a symlink, so it can't be forged to skip the migration or symlinked to clobber a root file
- ownership sweep: chown with -execdir so a parent directory swapped for a symlink mid-walk can't redirect the chown out of the volume
- validate inputs: restrict DEVICE_ACL_PATHS to /dev, require nonzero numeric EXTRA_GROUPS, and reject PUID/PGID that collide with the go2rtc ids
- docs: correct the TLS key ownership note to match what actually happens

docker/main/rootfs/etc/s6-overlay/s6-rc.d/init-devices/run

@@ -41,9 +41,14 @@ device_globs=(
 IFS=',' read -ra extra_globs <<< "${DEVICE_ACL_PATHS:-}"
 for extra in "${extra_globs[@]}"; do
     extra="${extra//[[:space:]]/}"
-    if [[ -n "$extra" ]]; then
-        device_globs+=("$extra")
+    if [[ -z "$extra" ]]; then
+        continue
     fi
+    if [[ "$extra" != /dev/* || "$extra" == *..* ]]; then
+        echo "[ERROR] DEVICE_ACL_PATHS entries must be under /dev, got '${extra}'" >&2
+        exit 1
+    fi
+    device_globs+=("$extra")
 done
 
 granted=0