feat: add --external-links flag for cross-origin links

Adds opt-in support for external (cross-origin) links in HTML
directory listings, resolving issue #135.

When --external-links is passed, the HTML parser detects <a href>
tags pointing to different origins, extracts the filename, and
exposes those files and directories alongside the local listing.

Key design & security decisions:
- First-wins deduplication: if two external links produce the same
  filename, the first one encountered is kept.
- HTTP credentials (-u/-p) are scoped to the mounted (root) server
  only. External servers returning HTTP 401/403 trigger a
  user-visible warning.
- External links ending with '/' are treated as directories;
  navigating into them triggers a recursive LinkTable_new() on
  the remote URL.
- LinkTable_fill() detects pre-populated f_url and skips URL
  construction for external links.
- Same-origin URLs shorter than ROOT_LINK_OFFSET are protected
  from buffer over-reads.
- Made URL scheme and host comparisons case-insensitive per
  RFC 3986 in is_external_url and is_cross_origin.
- Stripped fragment identifiers (#) along with query parameters
  when extracting filenames in external_url_to_filename.
- Sanitized unescaped path in LinkTable_new to prevent path
  traversal via ".." for external links.
- Ignored "." and ".." filenames when parsing external links.
- Refactored LinkHashSet_free to avoid const-cast qualifier drop.
- Sanitized URL-decoded slash characters in external filenames to
  prevent path traversal or invalid FUSE entry names.

Author: fangfufu

USAGE.md

@@ -49,6 +49,13 @@ HTTPDirFS supports the following usage flags:
             --zero-len-is-dir   If a file has a zero length, treat it as a directory
             --insecure-tls      Disable licurl TLS certificate verification by
                                 setting CURLOPT_SSL_VERIFYHOST to 0
+            --external-links    Include external (cross-origin) links from
+                                directory listings. When enabled, httpdirfs will
+                                follow <a href> tags pointing to other servers
+                                and expose their files alongside local links.
+                                HTTP credentials (-u/-p) are only applied to
+                                the mounted server; external servers requiring
+                                authentication will generate a warning.
             --single-file-mode  Single file mode - rather than mounting a whole
                                 directory, present a single file inside a virtual
                                 directory.

src/config.h

@@ -115,6 +115,8 @@ typedef struct {
     int refresh_timeout;
     /** \brief Try refreshing invalid links when reading a directory */
     int invalid_refresh;
+    /** \brief Include external (cross-origin) links from directory listings */
+    int external_links;
     /*--------------- Cache related ---------------*/
     /** \brief Whether cache mode is enabled */
     int cache_enabled;