Make a Filesystem class that can be subclassed for testing.

This change does not yet change all the classes that use the filesystem
to take Filesystem as a dependency. Those changes will come in follow-up
PRs.

This change is motivated by feedback in #4609. There I had created a
complicated interface to LevelDbOpener just so that different migration
scenarios could be tested, when in reality, I just needed to be able to
plumb through different values for the result of AppDataDir and related
functions.

Author: wilhuff