Arvados

Basic idea: When FUSE is mounted --read-write, a user can undelete a collection by moving the collection directory from anywhere under the TrashDirectory to a ProjectDirectory outside the TrashDirectory. rename methods see this operation and update the collection to set its expires_at attribute to null, and update the owner_uuid and name if appropriate.

#9590 says that the TrashDirectory and everything under it should be read-only. This story adds some nuance to that rule: only collection directories under the TrashDirectory, and their contents, should be read-only. The TrashDirectory itself and all ProjectDirectories under it should be read-write, to indicate to the user that they can do (some) write operations on the contents, like this move.

Moving the collection directory anywhere else (like somewhere else under TrashDirectory, or to the mount root when it's not a ProjectDirectory) is still an error.

If updating the API record fails, that should be reflected as an I/O error from the rename operation.