Search trusted prefixes for filesystem commands

Otherwise they'll get filtered out later anyway.

Also, move trusted command lookups to a helper, now that it's used twice, and fix path separators.