fix: wcow: cache: refactor the privilege logic down on the call stack

Fixes #5906, reverts #5980

Occasionally, the privilege disabling deffered call
is executed before some kernel-side operations are complete.
We therefore end up with some access denied errors
in `prepareDigest` -> `os.Open()`.

Fix this by taking the call closer to where the
privileged operation takes place, but outside the recursion
for optimal calls.

Signed-off-by: Anthony Nandaa <[email protected]>

Author: profnandaa

cache/contenthash/checksum.go

@@ -111,9 +111,6 @@ func (cm *cacheManager) Checksum(ctx context.Context, ref cache.ImmutableRef, p
 	if err != nil {
 		return "", nil
 	}
-	// only applies for Windows, it's a no-op on non-Windows.
-	enableProcessPrivileges()
-	defer disableProcessPrivileges()
 	return cc.Checksum(ctx, ref, p, opts, s)
 }
 
@@ -856,6 +853,10 @@ func (cc *cacheContext) scanChecksum(ctx context.Context, m *mount, p string, fo
 	k := convertPathToKey(p)
 	txn := cc.tree.Txn()
 	root = txn.Root()
+
+	// only applies to Windows, it's a no-op for the rest.
+	enableProcessPrivileges()
+	defer disableProcessPrivileges()
 	cr, updated, err := cc.checksum(ctx, root, txn, m, k, followTrailing)
 	if err != nil {
 		return nil, err

client/client_test.go

@@ -6883,9 +6883,6 @@ func readFileInImage(ctx context.Context, t *testing.T, c *Client, ref, path str
 }
 
 func testCachedMounts(t *testing.T, sb integration.Sandbox) {
-	// TODO(profnandaa): skipping on Windows, investigating. #5906
-	integration.SkipOnPlatform(t, "windows")
-
 	c, err := New(sb.Context(), sb.Address())
 	require.NoError(t, err)
 	defer c.Close()