Use /data as tmpfs mount point in 2SI setup

Design credit to @yujincheng08
Close #5146. Fix #5491, fix #3752

Previously, Magisk changes the mount point from /system to /system_root
by patching fstab to prevent the original init from changing root.
The reason why we want to prevent the original init from switching the
root directory is because it will then be read-only, making patching
and injecting magiskinit into the boot chain difficult.

This commit (ab)uses the fact that the /data folder will never be part
of early mount (because it is handled very late in the boot by vold),
so that we can use it as the mount point of tmpfs to store files.

Some advantages of this method:

- No need to switch root manually
- No need to modify fstab, which significantly improves compatibility
  e.g. avoid hacks for weird devices like those using oplus.fstab,
  and avoid hacking init to bypass fstab in device trees
- Supports skip_mount.cfg
- Support DSU

native/jni/init/rootdir.cpp

@@ -240,7 +240,7 @@ void SARBase::patch_rootdir() {
             make_pair(SPLIT_PLAT_CIL, "xxx"), /* Force loading monolithic sepolicy */
             make_pair(MONOPOLICY, sepol)      /* Redirect /sepolicy to custom path */
          });
-        if constexpr (avd_hack) {
+        if (avd_hack) {
             // Force disable early mount on original init
             init.patch({ make_pair("android,fstab", "xxx") });
         }
@@ -276,23 +276,9 @@ void SARBase::patch_rootdir() {
     // sepolicy
     patch_sepolicy(sepol);
 
-    // Restore backup files
-    struct sockaddr_un sun;
-    int sockfd = xsocket(AF_LOCAL, SOCK_STREAM | SOCK_CLOEXEC, 0);
-    if (connect(sockfd, (struct sockaddr*) &sun, setup_sockaddr(&sun, INIT_SOCKET)) == 0) {
-        LOGD("ACK init daemon to write backup files\n");
-        // Let daemon know where tmp_dir is
-        write_string(sockfd, tmp_dir);
-        // Wait for daemon to finish restoring files
-        read_int(sockfd);
-    } else {
-        LOGD("Restore backup files locally\n");
-        restore_folder(ROOTOVL, overlays);
-        overlays.clear();
-    }
-    close(sockfd);
-
     // Handle overlay.d
+    restore_folder(ROOTOVL, overlays);
+    overlays.clear();
     load_overlay_rc(ROOTOVL);
     if (access(ROOTOVL "/sbin", F_OK) == 0) {
         // Move files in overlay.d/sbin into tmp_dir