fusefrontend: implement our own Access()

Not having Access() means go-fuse emulates it by looking at Getattr().
This works fine most of the time, but breaks down on sshfs, where
sshfs-benchmark.bash shows this:

	gocryptfs/tests$ ./sshfs-benchmark.bash nuetzlich.net
	working directory: /tmp/sshfs-benchmark.bash.JQC
	sshfs mounted: nuetzlich.net:/tmp -> sshfs.mnt
	gocryptfs mounted: sshfs.mnt/sshfs-benchmark.bash.Wrz/gocryptfs.crypt -> gocryptfs.mnt

	sshfs-benchmark.bash:    sshfs  gocryptfs-on-sshfs
	git init                  3.98                6.80
	rsync                     7.71               10.84
	rm -R                     4.30rm: descend into write-protected directory 'gocryptfs.mnt/git1'?

The go-fuse emulation gets it wrong here because sshfs reports
permissions but does not enforce them.

Implement it ourselves properly.

internal/fusefrontend/node.go

@@ -99,6 +99,17 @@ func (n *Node) Getattr(ctx context.Context, f fs.FileHandle, out *fuse.AttrOut)
 	return 0
 }
 
+func (n *Node) Access(ctx context.Context, mode uint32) syscall.Errno {
+	dirfd, cName, errno := n.prepareAtSyscallMyself()
+	if errno != 0 {
+		return errno
+	}
+	defer syscall.Close(dirfd)
+
+	err := syscallcompat.Faccessat(dirfd, cName, mode)
+	return fs.ToErrno(err)
+}
+
 // Unlink - FUSE call. Delete a file.
 //
 // Symlink-safe through use of Unlinkat().