hst: check for insecure PulseAudio enablement

This is currently still a noop, but required for #26.

Signed-off-by: Ophestra <cat@gensokyo.uk>

hst/config.go

@@ -60,6 +60,9 @@ var (
 
 	// ErrEnviron is returned by [Config.Validate] if an environment variable name contains '=' or NUL.
 	ErrEnviron = errors.New("invalid environment variable name")
+
+	// ErrInsecure is returned by [Config.Validate] if the configuration is considered insecure.
+	ErrInsecure = errors.New("configuration is insecure")
 )
 
 // Validate checks [Config] and returns [AppError] if an invalid value is encountered.
@@ -106,6 +109,13 @@ func (config *Config) Validate() error {
 		}
 	}
 
+	// EPulse without EPipeWire is insecure
+	if et := config.Enablements.Unwrap(); !config.DirectPulse &&
+		et&EPipeWire == 0 && et&EPulse != 0 {
+		return &AppError{Step: "validate configuration", Err: ErrInsecure,
+			Msg: "enablement PulseAudio requires PipeWire, which is not set"}
+	}
+
 	return nil
 }