feat(rdp): remote audio and a shared folder redirected as a drive

- Audio: the RDPSND channel with IronRDP's cpal playback backend (PCM;
  Opus left out to avoid another native library). On by default for new
  RDP profiles. Building now needs the ALSA headers on Linux
  (libasound2-dev), added to CI, release and fuzz jobs and the build docs.
- Shared folder (Linux/macOS): one local folder appears on the remote
  desktop as a drive. IronRDP's native backend joins server paths onto
  the share unchecked, so it is wrapped in ConfinedDrive: create, list
  and rename paths with '..' components, NUL bytes, or that resolve
  through a symlink outside the share are refused (ACCESS_DENIED);
  tests cover the escapes.

Verified against xrdp (with FUSE): the remote read the shared file, and
writes, mkdir and rename landed in the local folder. Not verified:
audio playback (the test container has no sound module), and xrdp lists
the drive as 'ignored' and can't list its directories (an IronRDP/xrdp
naming and listing mismatch, fixed upstream for the name).

rust/core/src/models.rs

@@ -409,6 +409,10 @@ pub struct RdpConfig {
     /// Allow plain TLS logon for servers without Network Level Authentication (e.g. xrdp).
     #[serde(rename = "allowTLSOnly")]
     pub allow_tls_only: bool,
+    /// Play remote audio locally.
+    pub audio: bool,
+    /// Local folder shared with the remote desktop as a drive (empty: none). Linux and macOS.
+    pub shared_folder: String,
     /// Trust policy for the server's TLS certificate (pinned like an SSH host key).
     #[serde(deserialize_with = "lenient")]
     pub host_key_policy: HostKeyPolicy,
@@ -433,6 +437,7 @@ impl RdpConfig {
         RdpConfig {
             scale_to_fit: true,
             dynamic_resolution: true,
+            audio: true,
             proxy_type: "none".into(),
             ssh_port: DEFAULT_SSH_PORT.into(),
             ssh_auth_method: "publickey".into(),