We often want to do checks on all configured file paths: * relative paths * runtime immutability * sandbox immutability We need to scan: * type FILENAME * HiddenServiceDir * Log files * *Port unix sockets * ControlSocket * Any options that activate a file path, but don't allow it to be configured (OnionAuth etc.) Follow up to legacy/trac#32339 and legacy/trac#32344.