Don't run config ffmpeg as root (#24891)

* don't run a config ffmpeg.path as root at boot

The frigate and go2rtc run scripts probed "$ffmpeg_path" -version as root before dropping privileges, and resolve_ffmpeg_path only refused runtime-user-writable paths when frigate itself was a root service. In the default mode uid 1000 could set ffmpeg.path to a /config directory, plant bin/ffmpeg there, and get root on the next restart, and under FRIGATE_ROOT_SERVICES=go2rtc a root go2rtc used that path as its ffmpeg bin. The probe now runs as the service user whenever the service drops privileges, and resolve_ffmpeg_path refuses writable paths for whichever service will run the binary, returning the resolved path so a symlink can't be retargeted after the check. go2rtc falls back to the bundled build's libavformat version if its user can't run the custom build.

* resolve the full ffmpeg path under granular root

docker/main/rootfs/usr/local/ffmpeg/get_ffmpeg_path.py

@@ -25,4 +25,5 @@ except FileNotFoundError:
     config: dict[str, Any] = {}
 
 path = config.get("ffmpeg", {}).get("path", "default")
-print(resolve_ffmpeg_path(path, "ffmpeg"))
+service = sys.argv[1] if len(sys.argv) > 1 else "frigate"
+print(resolve_ffmpeg_path(path, "ffmpeg", service))

docker/main/rootfs/usr/local/go2rtc/create_config.py

@@ -103,7 +103,7 @@ if not is_valid_ffmpeg_path(path):
     print(
         "[ERROR] ffmpeg path contains spaces, quotes or shell characters, using the default ffmpeg instead."
     )
-ffmpeg_path = resolve_ffmpeg_path(path, "ffmpeg")
+ffmpeg_path = resolve_ffmpeg_path(path, "ffmpeg", "go2rtc")
 
 for key in apply_go2rtc_ffmpeg_config(go2rtc_config, ffmpeg_path):
     print(