Investigate owner/group/perms for generated/updated files

[CyrilBrulebois]

At the moment, all files (except in the WireGuard stack, where 0600 is being enforced everywhere) are created with default metadata, likely 0644. Some of them contain secrets, and should be protected. While doing so, we should make sure each service can still access its own files.

That probably means having to support 3 new attributes in PackageConfigFile:

• owner, defaulting to root
• group, defaulting to root
• perms, defaulting to 0644

and of course careful testing…