pub fn resolve_read_allowlist( allow: &Option<Vec<PathBuf>>) -> Result<HashSet<ReadDescriptor>, AnyError>