rc: fix leaking stack traces on panics GHSA-gwfq-86j8-7qhv

Before this change, rclone sent stack traces to the client on panic
capture in the rc. Stack traces can leak information which could be
useful to an attacker.

fs/rc/jobs/job.go

@@ -108,7 +108,11 @@ func (job *Job) OnFinish(fn func()) func() {
 func (job *Job) run(ctx context.Context, fn rc.Func, in rc.Params) {
 	defer func() {
 		if r := recover(); r != nil {
-			job.finish(nil, fmt.Errorf("panic received: %v \n%s", r, string(debug.Stack())))
+			// Log the full stack trace server-side only - it must not
+			// be returned to the rc caller as it leaks internal paths,
+			// dependency versions and memory addresses.
+			fs.Errorf(nil, "rc: job %d panic: %v\n%s", job.ID, r, string(debug.Stack()))
+			job.finish(nil, fmt.Errorf("panic received: %v", r))
 		}
 	}()
 	job.finish(fn(ctx, in))

fs/rc/jobs/job_test.go

@@ -234,6 +234,10 @@ func TestJobRunPanic(t *testing.T) {
 	assert.Equal(t, rc.Params{}, job.Output)
 	assert.True(t, job.Duration >= floatSleepTime)
 	assert.Contains(t, job.Error, "panic received: boom")
+	// The stack trace must not be leaked to the rc caller - it is
+	// logged server-side only.
+	assert.NotContains(t, job.Error, "goroutine")
+	assert.NotContains(t, job.Error, "runtime/debug.Stack")
 	assert.Equal(t, false, job.Success)
 	assert.Equal(t, true, job.Finished)
 	job.mu.Unlock()