FdoSecrets: Persist client authorizations across restarts using process chains in CustomData

[RikaKit2]

Overview

Fixes #8784

When applications or CLI helper processes query credentials via the Secret Service API (FdoSecrets), KeePassXC prompts for confirmation on every execution or restart, even when the user checks "Remember".

Problem

Client authorizations are currently stored only in memory (DBusClient::m_allowed), mapped to the ephemeral D-Bus address (:1.xxx). When the client disconnects, DBusMgr::dbusServiceUnregistered destroys the client instance and its permissions. For short-lived helper processes, every call uses a new PID and D-Bus address, so the "Remember" checkbox does not survive across invocations.

Changes

1. Process hierarchy identifier (PeerInfo::chainIdentifier):
   Constructs an ancestry string from info.hierarchy using process executable names (e.g. parent->caller). Root systemd/init processes are excluded. Using QFileInfo::fileName() ensures portability across standard filesystem hierarchies and content-addressed layouts like NixOS.
2. Persistence via Entry CustomData (CustomData::FdoSecretsAuthChains):
   When access is granted with "Remember" checked, the chain is appended to the target entry's CustomData under FDO_SECRETS_AUTH_CHAINS (visible in GUI under Edit entry -> Properties -> Plugin Data).
   • Values are stored as a newline-delimited list (\n), allowing multiple distinct workflows (e.g. an IDE subprocess and a terminal shell) to be authorized concurrently for the same credential without overwriting each other.
   • Authorizations can be inspected, edited, or revoked directly by the user from the entry's Properties tab.
3. Authorization check on access:
   Item::locked() and UnlockPrompt::unlockItems() check if the caller's process chain is listed in the entry's CustomData. If matched, access is granted directly without showing AccessControlDialog.

---

AI Usage Disclosure

In accordance with the project's Contributing Guidelines, this change was developed with the assistance of an AI coding agent (Oh My Pi using Google Gemini 3.8 Flash). The implementation was formatted with git clang-format and verified under Linux (Wayland).

---

Screenshots

---

Testing strategy

1. With Secret Service enabled, request a credential via an external helper (secret-tool lookup service <name>).
2. In the confirmation dialog, check "Remember" and select "Allow Selected" (or "Allow All & Future").
3. Verify that FDO_SECRETS_AUTH_CHAINS appears in the entry properties under Plugin Data and the database is saved.
4. Restart KeePassXC and run the same lookup command again:
   • Expected: Secret is returned immediately without a prompt dialog.
5. Request the same credential from a different process chain (e.g. terminal shell):
   • Expected: A prompt dialog appears for the new chain.
   • Confirm with "Remember" and verify that the new chain is appended to FDO_SECRETS_AUTH_CHAINS on a new line alongside the existing one. Both callers now have seamless access.
6. Run the lookup from an unlisted process tree:
   • Expected: The confirmation dialog is displayed.

---

Type of change

• ✅ Bug fix (non-breaking change that fixes an issue)
• ✅ New feature (change that adds functionality)

[michaelk83]

Handled in #13610