pub fn resolve_write_allowlist( allow: &Option<Vec<PathBuf>>) -> Result<HashSet<WriteDescriptor>, AnyError>