vm: Fix permissions in rootfs

The 'mktemp -d' command creates a directory with mode 0700. This mode
was stored by mksquashfs, making the root (and thus the whole tree) of
the rootfs unreadable in the sandbox for any user except root.

Note that environments using the install_debs function did not exhibit
the wrong behaviour. Debian archives contain an entry for the root
directory, overwriting permissions on extraction.

This patch also sets umask in the mkrootfs.sh script to avoid relying on
the developer environment for newly created files.