feat: Add secure input only channel for data streaming

[MoeMahhouk]

Summary

• Add secure FIFO-based input channel for streaming data to searcher containers
• Implement security-hardened feed-data command with authentication and validation
• Add systemd service for automatic FIFO setup with proper ownership controls

Security Features

• Root-owned FIFO: Prevents tampering and symlink attacks
• Read-only container mount: Container cannot modify the input channel
• SSH authentication: Leverages existing searcher SSH access
• Rate limiting: 100MB/s limit prevents accidental DoS
• Ownership validation: Strict checks prevent security bypasses

Implementation Details

• New feed-data command in searchersh.c for authenticated data streaming
• setup-input-fifo.sh creates secure FIFO with proper permissions
• feed-data-helper handles the actual data transfer with security validation
• Added pv package for rate limiting and progress monitoring
• Systemd service ensures FIFO is ready before container starts

Usage

# Stream data to searcher container
cat data.json | ssh searcher@<vm ip> feed-data

# Continuous streaming (no timeout)
your-data-generator | ssh searcher@host feed-data

[Ruteri]

Can the searcher influence this, leaking data through how they read the data? Might be fine, but I would also worry about the rate limit

[MoeMahhouk]

no they can't because this is set by the host-os and not the searcher.
I added the rate-limit just to avoid self DoSing but ofc we can relax it even more or remove it fully while documenting/communicating it with the searcher to keep an eye on the ingress