Search trusted prefixes for filesystem commands

Otherwise they'll get filtered out later anyway.

Also, move trusted command lookups to a helper, now that it's used twice,
and fix path separators.