Scaffolding files in sites/default is problematic

Problem/Motivation

If you use the drupal-composer scaffold plugin in its default state then sites/default/default.services.yml and sites/default/default.settings.php are scaffolded from core/assets/scaffold/files/default.settings.php and core/assets/scaffold/files/default.services.yml respectively.

If this happens on an already installed site with a normal settings.php (ie. doesn't have skip_permissions_hardening set to TRUE) then it will fail because the Drupal's permissions hardening will set the sites/default folder to be read-only.

One solution would be to customise your composer json and do something like

        "drupal-scaffold": {
            "file-mapping": {
                "[web-root]/sites/default/default.settings.php": false,
                "[web-root]/sites/default/default.services.yml": false
            }
        }    

But then you have the problem that if you do a build on CI server and run tests then they'll fail because the test will try to do an install by copying the default.settings.php.

Proposed resolution

Consider changing the default for these scaffold files to "overwrite": false so that if they exist they are not overwritten. Or adding something that allows us to ignore a fail if these can't be scaffolded.

Not really sure yet...

Remaining tasks

User interface changes

API changes

Data model changes

Release notes snippet