filer: let a nested path rule turn worm off (#10503)

* filer: let a nested path rule turn worm off

mergePathConf ORs the booleans, so worm set on a bucket could never be
lifted on a directory under it, while every string field is overridden by
the more specific rule. Make worm tri-state instead: unset inherits, set
wins. readOnly, fsync and disableChunkDeletion keep the OR, so a nested
rule still cannot escape a lock the bucket set.

Configurations written before this carry an explicit "worm": false on
every rule, because they are marshalled with EmitUnpopulated. Reading
those back as an override would quietly drop worm from nested paths, so
filer.conf is now stamped with a version and the flag is dropped to unset
when the version predates it.

* filer: copy the worm value out of the matched rule

mergePathConf aliased the pointer into the merged result, so a caller that
wrote through it would reach into the stored rule.

weed/pb/filer_pb/filer_vtproto.pb.go

@@ -4814,9 +4814,9 @@ func (m *FilerConf_PathConf) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
 		i--
 		dAtA[i] = 0x78
 	}
-	if m.Worm {
+	if m.Worm != nil {
 		i--
-		if m.Worm {
+		if *m.Worm {
 			dAtA[i] = 1
 		} else {
 			dAtA[i] = 0
@@ -8166,7 +8166,7 @@ func (m *FilerConf_PathConf) SizeVT() (n int) {
 	if m.DisableChunkDeletion {
 		n += 2
 	}
-	if m.Worm {
+	if m.Worm != nil {
 		n += 2
 	}
 	if m.WormGracePeriodSeconds != 0 {
@@ -21715,7 +21715,8 @@ func (m *FilerConf_PathConf) UnmarshalVT(dAtA []byte) error {
 					break
 				}
 			}
-			m.Worm = bool(v != 0)
+			b := bool(v != 0)
+			m.Worm = &b
 		case 15:
 			if wireType != 0 {
 				return fmt.Errorf("proto: wrong wireType = %d for field WormGracePeriodSeconds", wireType)