FileVault, recovery keys and more

[puccia]

Hi Simon!

Thank you very much for your apfs-fuse work!

I wanted to be able to use it to mount encrypted APFS volumes that have a recovery key, so I started implementing that functionality; then I also fixed some bits that I encountered as I went on.

The main changes in these commits are:

1. Allow mounting of FileVault-encrypted APFS volumes, as opposed to regular encrypted volumes;
2. Allow decryption through a (personal, not institutional) recovery key, as opposed to a regular password;
3. Fix decryption when an extent's crypto_id does not match the block number;
4. Fix reading fragmented files;
5. Fix decompression for several algos, especially the handling of uncompressed blocks;
6. Provide a "strict" mode that returns errors when decompression fails;
7. Minor enhancements (allow spaces in passwords; allow specifying a container offset, which is handy when working with raw disk images).

I'd very much like to have this functionality integrated upstream. Would you consider that? Is there something else you'd like me to do? I'll do my best to meet your requirements for that (e.g. style changes, split PRs, different code, you name it.)

Thanks again!