drm: dlopen libdrmtap by absolute path + unit-test the _drm admission and re-auth (review 5e, 6a)

5e: the deb dropped /usr/lib/rustdesk into /etc/ld.so.conf.d so the private libdrmtap
could be found by soname -- a system-wide search-path entry that lets it shadow a
system library for every binary on the host, which Debian Policy 10.2 forbids. Resolve
it by absolute path (/usr/lib/rustdesk/libdrmtap.so.0) at the dlopen site instead, with
the bare sonames kept only as a dev fallback, and drop the ld.so.conf.d file and the
ldconfig/try-restart postinst entirely (the .so is present at its absolute path right
after unpack, so the pre-warm resolves with no linker-cache step). The dlopen site is
this PR's own code, so this is in scope, not a follow-up.

6a: extract the _drm admission bound and the per-frame re-auth decision into pure
helpers (drm_conn_admitted, drm_peer_authorized) and unit-test them: admission admits
strictly below MAX_DRM_CONNS and rejects at/above it; re-auth passes root always,
passes a non-root peer only while it equals the active-session uid, and fails closed on
a switched-away, unknown-session, or unknown-peer case. (The /proc/exe-mismatch
rejection is exercised by the accept-time authorize call; unit-testing it in isolation
would need a second process with a different exe, so it stays an integration concern.)

libs/scrap/src/common/drmtap_dl.rs

@@ -178,8 +178,16 @@ const DRMTAP_ABI_MAJOR: c_int = 0;
 
 impl DrmtapLib {
     fn load() -> Option<Self> {
-        // soname first (what a packaged .so installs), then the dev symlink.
-        const LIB_NAMES: [&str; 2] = ["libdrmtap.so.0", "libdrmtap.so"];
+        // Absolute install path FIRST: the deb bundles the .so privately under /usr/lib/rustdesk and
+        // deliberately does NOT register that dir in the system-wide ld.so search path (Debian Policy
+        // 10.2 forbids a private lib shadowing system libraries for every binary), so the packaged
+        // build must resolve it by absolute path. The bare sonames remain as a fallback for a dev build
+        // where the .so is reachable via LD_LIBRARY_PATH or a local ldconfig.
+        const LIB_NAMES: [&str; 3] = [
+            "/usr/lib/rustdesk/libdrmtap.so.0",
+            "libdrmtap.so.0",
+            "libdrmtap.so",
+        ];
         unsafe {
             let (lib, name) = LIB_NAMES
                 .iter()