safcm: add experimental support to sync from Windows hosts

This is _very_ experimental. The testsuite doesn't yet run on Windows
and only a few manual tests were run. Basically this is only present
because it was used to verify our changes to always use slash-separated
paths in the configuration on a real system. It seemed a waste to just
throw it away.

To build the binary for windows use (empty GOFLAGS to disable -race):

    make GOOS=windows GOFLAGS=