Function declare_host_paths 

pub fn declare_host_paths(
    entries: &[HostPathEntry],
    home: Option<&Path>,
) -> Result<Vec<DeclaredHostPath>, HostPathRefusal>

Checks the shape of every entry and expands ~ against home, the HOME mur runs with.

Refuses an entry with no path or no access, an access other than read or read-write, a relative path (~user/… and $VAR/… are not expanded, so they are relative), a path that is or folds to /, and a path an earlier entry already names.