macOS: honor the CheckFilesystem repair flag (#1791)

CoreMacOSX::CheckFilesystem() ignored both its mountedVolume and repair
arguments and always just launched Disk Utility.app, so the "Check
Filesystem" and "Repair Filesystem" menu items behaved identically and
neither acted on the mounted volume. On Linux/BSD the same operation runs
fsck and honors the flag (passing -n only when repair is false).

Run diskutil on the VeraCrypt virtual device, choosing verifyVolume or
repairVolume per the flag (diskutil unmounts the inner filesystem itself
as needed). The Core layer has no GUI, so the result is shown in a
Terminal window via a temporary .command script; it falls back to
launching Disk Utility.app when no virtual device is available.

Run the macOS check in the unprivileged application process. VeraCrypt does
not need to create or launch the helper script from the elevated core
service: diskutil operates on the mounted virtual device and macOS handles
any device authorization requirements. Once a device-hosted mount has
started the elevated core service, every later service request is routed to
that root process. There it would create the helper script as root (0700)
and open a Terminal in the GUI session that the user could neither read nor
execute. CoreServiceProxy::CheckFilesystem now invokes the core
implementation directly on macOS instead of sending a service request, so
the script is always owned by the GUI user.

The device path is strictly validated as /dev/[r]diskN[sM] before being
single-quoted into the command. The helper script is created securely in
the per-user temp directory via mkstemps() (atomic O_EXCL/0600, fchmod
0700 by descriptor, close() checked for deferred write errors, unlinked on
any failure) rather than at a predictable, enumerable path in the
world-writable /tmp, guarding against a symlink/race on the executed
script. A trap removes the script on exit even if the window is closed
early, and it is also unlinked if launching Terminal fails. The script
captures $? so diskutil's result, including failures, is shown before the
script exits.

Replace the macOS pre-check message (which still told the user Disk
Utility would open and to pick Verify/Repair manually) with check- and
repair-specific text describing the new automatic diskutil flow.

Seed the two new strings into all translation files with the English
text so the XML key-completeness check passes; localization can follow.

Co-authored-by: Damian Rickard <damian@rickard.us>

Translations/Language.it.xml

@@ -1498,6 +1498,8 @@
     <entry lang="it" key="LINUX_REMOUNT_BECAUSEOF_SETTING">Nota che prima di poter usare questa impostazione tutti i volumi attualmente montati devono essere rimontati.</entry>
     <entry lang="it" key="LINUX_UNKNOWN_EXC_OCCURRED">Si è verificata un'eccezione sconosciuta.</entry>
     <entry lang="it" key="LINUX_FIRST_AID">'Utilità disco' verrà avviata dopo aver selezionato 'OK'.\n\nSeleziona il volume nella finestra 'Utilità disco' e seleziona 'Verifica disco' o 'Ripara disco' nella pagina 'Pronto soccorso'.</entry>
+    <entry lang="en" key="MACOSX_CHECK_FILESYS">A Terminal window will open after you press 'OK' and check the file system on the selected VeraCrypt volume using 'diskutil'. The result will be shown in that window.\n\nIf the check cannot be started, Disk Utility will be launched instead.</entry>
+    <entry lang="en" key="MACOSX_REPAIR_FILESYS">A Terminal window will open after you press 'OK' and attempt to repair the file system on the selected VeraCrypt volume using 'diskutil'. The result will be shown in that window.\n\nIf the repair cannot be started, Disk Utility will be launched instead.</entry>
     <entry lang="it" key="LINUX_MOUNT_ALL_DEV">Monta tutti i dispositivi</entry>
     <entry lang="it" key="LINUX_ERROR_LOADING_CONFIG">Errore durante il caricamento dei file di configurazione situati in</entry>
     <entry lang="it" key="LINUX_SELECT_FREE_SLOT">Seleziona uno slot unità libero nell'elenco.</entry>