Add support for XFS bigtime (fixes #12)

[robbgatica]

Summary

Implements support for the XFS bigtime feature, which extends timestamp range from 2038 to 2486+ using 64-bit nanosecond counters.

Changes

This PR adds bigtime feature detection and timestamp parsing for XFS filesystems:

Modified Files (8 files):

1. libfsxfs/fsxfs_superblock.h - Added v5 feature fields to on-disk structure
2. libfsxfs/libfsxfs_superblock.h - Added features_incompat to internal structure
3. libfsxfs/libfsxfs_superblock.c - Read features_incompat from v5 superblocks
4. libfsxfs/libfsxfs_io_handle.h - Added features_incompat field
5. libfsxfs/libfsxfs_volume.c - Copy features_incompat to io_handle
6. libfsxfs/libfsxfs_definitions.h.in - Added LIBFSXFS_INCOMPAT_FEATURE_FLAG_BIGTIME
7. libfsxfs/libfsxfs_inode.h - Updated libfsxfs_inode_read_data() signature
8. libfsxfs/libfsxfs_inode.c - Implemented bigtime detection and conversion

Implementation Details

• Detects bigtime via features_incompat field (bit 0x08) in v5 superblocks
• Converts bigtime 64-bit nanosecond counters to Unix epoch nanoseconds
• Maintains full backward compatibility with legacy XFS filesystems
• Handles all 4 timestamp types: access, modification, inode_change, creation

Testing

Verified with:

• Bigtime XFS filesystems (correct 2025 timestamps)
• Backward compatibility maintained
• Some basic edge cases: epoch (1970), Y2038 boundary, far future (2100+)
• Feature combinations: bigtime + reflink + rmapbt
• Python bindings (pyfsxfs) - timestamps flow correctly to Plaso

Resolves

• Fixes add support for bigtime feature #12
• Should resolve Request: Add XFS bigtime suport log2timeline/plaso#4986

References

• XFS Bigtime Documentation: https://docs.kernel.org/filesystems/xfs/xfs-online-fsck-design.html#timestamps
• Plaso Issue: Request: Add XFS bigtime suport log2timeline/plaso#4986

[joachimmetz]

Thanks for the proposed changes I'll take a look at soon at time permits, note that this would require tests and test data as well before this code is ready to be merged

[robbgatica]

No problem at all, I'll keep any eye out for any comments/corrections in the meantime. Thanks!