bcachefs changes for 6.10-rc1

- More safety fixes, primarily found by syzbot

- Run the upgrade/downgrade paths in nochnages mode. Nochanges mode is
  primarily for testing fsck/recovery in dry run mode, so it shouldn't
  change anything besides disabling writes and holding dirty metadata in
  memory.

  The idea here was to reduce the amount of activity if we can't write
  anything out, so that bringing up a filesystem in "super ro" mode
  would be more lilkely to work for data recovery - but norecovery is
  the correct option for this.

- btree_trans->locked; we now track whether a btree_trans has any btree
  nodes locked, and this is used for improved assertions related to
  trans_unlock() and trans_relock(). We'll also be using it for
  improving how we work with lockdep in the future: we don't want
  lockdep to be tracking individual btree node locks because we take too
  many for lockdep to track, and it's not necessary since we have a
  cycle detector.

- Trigger improvements that are prep work for online fsck

- BTREE_TRIGGER_check_repair; this regularizes how we do some repair
  work for extents that goes with running triggers in fsck, and fixes
  some subtle issues with transaction restarts there.

- bch2_snapshot_equiv() has now been ripped out of fsck.c; snapshot
  equivalence classes are for when snapshot deletion leaves behind
  redundant snapshot nodes, but snapshot deletion now cleans this up
  right away, so the abstraction doesn't need to leak.

- Improvements to how we resume writing to the journal in recovery. The
  code for picking the new place to write when reading the journal is
  greatly simplified and we also store the position in the superblock
  for when we don't read the journal; this means that we preserve more
  of the journal for list_journal debugging.

- Improvements to sysfs btree_cache and btree_node_cache, for debugging
  memory reclaim.

- We now detect when we've blocked for 10 seconds on the allocator in
  the write path and dump some useful info.

- Safety fixes for devices references: this is a big series that changes
  almost all device lookups to properly check if the device exists and
  take a reference to it.

  Previously we assumed that if a bkey exists that references a device
  then the device must exist, and this was enforced in .invalid methods,
  but this was incorrect because it meant device removal relied on
  accounting being correct to not leave keys pointing to invalid
  devices, and that's not something we can assume.

  Getting the "pointer to invalid device" checks out of our .invalid()
  methods fixes some long standing device removal bugs; the only
  outstanding bug with device removal now is a race between the discard
  path and deleting alloc info, which should be easily fixed.

- The allocator now prefers not to expand the new
  member_info.btree_allocated bitmap, meaning if repair ever requires
  scanning for btree nodes (because of a corrupt interior nodes) we
  won't have to scan the whole device(s).

- New coding style document, which among other things talks about the
  correct usage of assertions
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEKnAFLkS8Qha+jvQrE6szbY3KbnYFAmZKJQgACgkQE6szbY3K
bnZETg//SU9H0OHnBSMB/cteF6PKo9QR+dhT+3n+gWTxl0o/egbGTqwbzVqGtd2f
J6II1BsDk8VoTOb/gFfLRShlmJfnj2jpRThU265faR/7LQYeSaqndDPkjOpTayAD
Nj/DJyiSUTL753rZh3yUhOpOIHf7iapH6wuaZCPfhdfk+yvZNW8iz07JHjHLKRp8
I2cFH0r6kN916NdRkt9oDCz68WouT8eWTqwcKra04XsLEZjNJHxLpKMq4M8UdPc7
YynJPVt+aP8+VduGIq6pV8Co3afCP2oUywo11JpRmvLsw4tex/59wxOYtpMfgn6k
4H+9WqiBwkbmnLDrfFHWRameS6F/7+GRAOVuz9nkmfk61UPU15gLjSRffqZ6u2YC
7vbrXgebId/sZXtBpQd83RMMX52BnEJah0upNJ54IsSqfDYkU9lwl6CEyYpcX1hf
YNBGBTbspZztc3AB13b3ow421FMhaySUg0FDmntMR9O8Z6/BXk7Ykc7b8DPEfrFs
W6JY7q+ARBxr+EgFcV74fvMCf7NJTAhyv80AKryo7NFU2JZOyyaTxcTGSnolX4Mi
lyHiOgicmOX+vy3vbC1dZoDcmIDJ4Uc0vixYcpKiZqxlR8XJ+wpevC50TEhxrcW+
ZO4SloQvgyjI34xu/gZgjRYb3BhXK3x+ougVFpRG8V8zQ/+ccWg=
=MKrF
-----END PGP SIGNATURE-----