RepoConfigLoader: raise PermissionDenied more
config: raise PermissionDenied more

This enables clear reporting of "Permission Denied" when appropriate,
instead of triggering nonsensical messages about invalid profiles or
repositories.