macOS: run APFS formatter elevated

APFS volume creation can still fail with Permission denied after preparing the raw and block device aliases because newfs_apfs performs privileged APFS container and volume operations beyond opening the device nodes.

Route APFS formatting through the elevated CoreService path for non-root macOS runs. Keep the elevated interface narrow by sending only the target device and invoking user UID/GID, validate the device path on the privileged side, rebuild the formatter arguments there, and execute /sbin/newfs_apfs by absolute path to avoid PATH shadowing.

Pass -U/-G so the created filesystem preserves the invoking user ownership. Apply the same path to GUI and text-mode creation.

src/Main/TextUserInterface.cpp

@@ -1078,7 +1078,9 @@ namespace VeraCrypt
 			{
 				RestoreMacOSXFormatterDeviceOwners (*finally_arg);
 			});
-			PrepareMacOSXFormatterDevice (virtualDevice, changedDeviceOwners);
+			bool useElevatedAPFSFormatter = UseElevatedMacOSXAPFSFormatter (fsFormatter);
+			if (!useElevatedAPFSFormatter)
+				PrepareMacOSXFormatterDevice (virtualDevice, changedDeviceOwners);
 #else
 			UserId origDeviceOwner ((uid_t) -1);
 
@@ -1123,9 +1125,18 @@ namespace VeraCrypt
 				}
 			}
 
+#ifdef TC_MACOSX
+			if (IsMacOSXAPFSFormatter (fsFormatter) && !useElevatedAPFSFormatter)
+				AddMacOSXAPFSFormatterUserArgs (args);
+#endif
+
 			args.push_back (string (virtualDevice));
 
+#ifdef TC_MACOSX
+			ExecuteMacOSXFilesystemFormatter (fsFormatter, args);
+#else
 			Process::Execute (fsFormatter, args);
+#endif
 		}
 #endif // TC_UNIX