macOS: honor the CheckFilesystem repair flag (#1791)

CoreMacOSX::CheckFilesystem() ignored both its mountedVolume and repair
arguments and always just launched Disk Utility.app, so the "Check
Filesystem" and "Repair Filesystem" menu items behaved identically and
neither acted on the mounted volume. On Linux/BSD the same operation runs
fsck and honors the flag (passing -n only when repair is false).

Run diskutil on the VeraCrypt virtual device, choosing verifyVolume or
repairVolume per the flag (diskutil unmounts the inner filesystem itself
as needed). The Core layer has no GUI, so the result is shown in a
Terminal window via a temporary .command script; it falls back to
launching Disk Utility.app when no virtual device is available.

Run the macOS check in the unprivileged application process. VeraCrypt does
not need to create or launch the helper script from the elevated core
service: diskutil operates on the mounted virtual device and macOS handles
any device authorization requirements. Once a device-hosted mount has
started the elevated core service, every later service request is routed to
that root process. There it would create the helper script as root (0700)
and open a Terminal in the GUI session that the user could neither read nor
execute. CoreServiceProxy::CheckFilesystem now invokes the core
implementation directly on macOS instead of sending a service request, so
the script is always owned by the GUI user.

The device path is strictly validated as /dev/[r]diskN[sM] before being
single-quoted into the command. The helper script is created securely in
the per-user temp directory via mkstemps() (atomic O_EXCL/0600, fchmod
0700 by descriptor, close() checked for deferred write errors, unlinked on
any failure) rather than at a predictable, enumerable path in the
world-writable /tmp, guarding against a symlink/race on the executed
script. A trap removes the script on exit even if the window is closed
early, and it is also unlinked if launching Terminal fails. The script
captures $? so diskutil's result, including failures, is shown before the
script exits.

Replace the macOS pre-check message (which still told the user Disk
Utility would open and to pick Verify/Repair manually) with check- and
repair-specific text describing the new automatic diskutil flow.

Seed the two new strings into all translation files with the English
text so the XML key-completeness check passes; localization can follow.

Co-authored-by: Damian Rickard <damian@rickard.us>

Translations/Language.ko.xml

@@ -1498,6 +1498,8 @@
     <entry lang="ko" key="LINUX_REMOUNT_BECAUSEOF_SETTING">현재 설정을 적용하려면 현재 마운트된 볼륨들을 다시 마운트해야 합니다.</entry>
     <entry lang="ko" key="LINUX_UNKNOWN_EXC_OCCURRED">알 수 없는 오류가 발생했습니다.</entry>
     <entry lang="ko" key="LINUX_FIRST_AID">"'확인'을 누르면 디스크 유틸리티가 실행될 것입니다\n\n디스크 유틸리티 창에서 볼륨을 선택하고 '응급 처치' 페이지에서 '디스크 확인' 또는 '디스크 수리' 버튼을 누르십시오.</entry>
+    <entry lang="en" key="MACOSX_CHECK_FILESYS">A Terminal window will open after you press 'OK' and check the file system on the selected VeraCrypt volume using 'diskutil'. The result will be shown in that window.\n\nIf the check cannot be started, Disk Utility will be launched instead.</entry>
+    <entry lang="en" key="MACOSX_REPAIR_FILESYS">A Terminal window will open after you press 'OK' and attempt to repair the file system on the selected VeraCrypt volume using 'diskutil'. The result will be shown in that window.\n\nIf the repair cannot be started, Disk Utility will be launched instead.</entry>
     <entry lang="ko" key="LINUX_MOUNT_ALL_DEV">모든 장치 마운트</entry>
     <entry lang="ko" key="LINUX_ERROR_LOADING_CONFIG">특정 위치의 설정 파일 불러오기 실패: </entry>
     <entry lang="ko" key="LINUX_SELECT_FREE_SLOT">리스트에서 빈 드라이브 자리를 선택하세요.</entry>