btrfs: stripe_alloc: allow-rmw policy property and mount option

btrfs: stripe_alloc: allow-rmw policy property and mount option

Replace the provisional stripe_alloc_nocow flag with the settled
interface: a word-list policy naming the cases in which stripe_alloc
may permit the legacy unsafe RMW, each independently:

  nodatacow  in-place writes for nodatacow files' extents
  prealloc   in-place writes into preallocated extents
  fsync      waive the close-at-log-commit guarantee: no settling, no
             per-inode LOG steering, no carry-forward; logged stripes
             may be extended and RMWed as before those patches

It is "allow_rmw", not "allow_overwrite": the fsync case overwrites
nothing, but all three permit read-modify-write of stripes that a
degraded crash can then tear.  The nodatacow and prealloc cases still
require per-extent stripe isolation (the blast radius stays confined to
the writing file); fsync restores the 3a-era exposure where a degraded
crash may cost just-fsynced data, detectably, in exchange for none of
the log-commit costs.

The policy is persistent as the btrfs.stripe_alloc_allow_rmw property
on the top-level root directory, following stripe_alloc's precedent
(applied when the root inode loads during mount, before any user IO),
with a mount option of the same name as a non-persistent override; the
effective policy is their union.  Words are separated by comma, space
or colon -- the mount option form must use colon, since mount splits
options at commas.  Everything defaults off: plain stripe_alloc keeps
forcing COW and keeps the full fsync guarantee.

Assisted-by: Claude:claude-fable-5