sftp: match permission paths on path-component boundaries (#10311)

* sftp: match permission paths on path-component boundaries

Permission checks compared paths with raw string prefixes, so a
permission entry for /tenants/alice also matched sibling paths such as
/tenants/alice-archive, letting a scoped user read and overwrite
another tenant's files. The home directory containment check had the
same flaw. Route both through pathWithin, which cleans the paths and
requires exact equality or a separator-delimited descendant.

* sftp: clean permission path into a local when ranking matches

test/sftp/testdata/userstore.json

@@ -31,6 +31,17 @@
     },
     "Uid": 1002,
     "Gid": 1002
+  },
+  {
+    "Username": "scoped",
+    "Password": "scopedpassword",
+    "PublicKeys": [],
+    "HomeDir": "/",
+    "Permissions": {
+      "/tenants/alice": ["read", "write", "list"]
+    },
+    "Uid": 1003,
+    "Gid": 1003
   }
 ]