Give --inode-file-handles an obligatory argument

What I read from issue #17 (closed) is that the first thing we must do is have --inode-file-handles take an obligatory (trying to avoid “mandatory”) argument and not be an alias for the new --inode-file-handles=fallback anymore. We must do this before the 1.0 release.

This series does this, and also has the fix strongly suggested by Vivek, which is to return all errors from FileHandle::to_openable() to the guest instead of considering them a reason to fall back to an O_PATH FD. I included that because this way the documentation on what --inode-file-handles=fallback does is final.

(Adding --inode-file-handles=mandatory seems trivial, but before we can do that, we need this change here anyway, so let’s start with this, and then do that.)

Tested with pjdfstest, and by reverting b9ac8c31, running with sandbox=none, and seeing that accessing the mount in the guest fails.