A fight over voluntary CSAM detection has turned into a test of how far EU lawmakers will let platforms inspect communications without eroding privacy by design.