[SECURITY] Refactor and fix FAL user permission handling

* User permissions are only applied to storage objects
  that are attached to a member variable of
  BackendUserAuthentication. This is error prone
  and leads to insufficient (no) checks if the code
  fetches a storage directly from the factory
  (like edit document controller does)
  Instead, apply the permissions by using a signal
  in StorageFactory directly after the storage object
  is built.

* Refactor the mount point handling, especially the
  user and group home directories, which was completely
  broken after the introduction of FAL. File mounts
  are now also applied to the storage on creation.

* Make fallback storage 0 read only and not browsable.

Fixes: #51327
Releases: 6.2, 6.1, 6.0
Change-Id: If1fa18486cf051a7f4489e36691d42786386df63
Security-Commit: 936dbaf5d16acd36b668dcf033eb343fc5e2f7bf
Security-Bulletin: TYPO3-CORE-SA-2013-003
Reviewed-on: https://review.typo3.org/23597
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] Deny arbitrary code execution possibility for editors

Because the filename is sanitized in the driver
after the check for denied file extensions is
performed, it was still possible to rename files
with denied file extensions.

We now perform the file extension check
on the final filename which is going to be used
by the driver.

This change makes the sanitizing method public
and introduces a basic implementation in
AbstractDriver to not break existing driver
implementations.

Fixes: #51495
Releases: 6.2, 6.1, 6.0
Change-Id: I2c055b7b070a5e13c2172d1f20fdcd83ee597e08
Security-Commit: de60d4ef37fc582e6349d5fa8ed13ec30d4892ff
Security-Bulletin: TYPO3-CORE-SA-2013-003
Reviewed-on: https://review.typo3.org/23598
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader