otherwise they do not inherit the permissions of the parent, as they are created before the ACL pass

this ensures that uploads from SFTP or SSH users are writable by the webserver

provisionacl would fail if it would find files it doesn't own, which is common in files/ as they are uploaded by the webserver.

we just do a warning now

this will widen the attack surface for #762138, but since people can
upload module code and root the install already anyways, it's not
worth the trouble right now.

this also fixes #1428526, coincidentally enough, because -P skips
symlinks it finds

sites directory directly

we make the files and directories functionality generic so that they
can be more easily be reused by third party modules, which was
requested for CiviCRM in #1222772.

This should fix #1195598

we do not have the client name to operate with at that point

this required refactoring the directory handling

we used to flush ACLs we were setting, which was breaking the default aegir ACL

we used to only create a default ACL

not running in any other hook right now