Build from commits that are checked, and refuse unsafe paths

The plugin runs inside the input method and sees everything that is typed, so
what it is built from matters. build.sh used to download a tag archive and a
yoga archive without checking them. It now fetches both by commit hash and
verifies the hash afterwards: a tag can be moved and an archive swapped, a
commit hash cannot be faked. A version without a pinned commit is refused
unless FCITX_COMMIT is given. Archive checksums were not used on purpose, GitHub
does not keep the bytes of generated archives stable.

enable-autostart.sh writes paths into an Exec line and a service file and now
refuses paths that would need quoting there.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

scripts/enable-autostart.sh

@@ -17,6 +17,11 @@ addondir=$(dirname "$lib")
 system_addondir=$(pkg-config --variable=addondir Fcitx5Core 2>/dev/null || true)
 system_addondir=${system_addondir:-/usr/lib64/fcitx5}
 dirs="$addondir:$system_addondir"
+# The paths are written into an Exec line and a service file, refuse anything
+# that would need quoting there instead of producing a broken or surprising line.
+case $dirs in
+    *[[:space:]\"\'\\\$\`%]*) echo "unsupported characters in $dirs" >&2; exit 1 ;;
+esac
 
 autostart=$config/autostart/org.fcitx.Fcitx5.desktop
 service=$data/dbus-1/services/org.fcitx.Fcitx5.service