Security: Don't allow builders to change permissions on files they don't own

It turns out that in multi-user Nix, a builder may be able to do

  ln /etc/shadow $out/foo

Afterwards, canonicalisePathMetaData() will be applied to $out/foo,
causing /etc/shadow's mode to be set to 444 (readable by everybody but
writable by nobody).  That's obviously Very Bad.

Fortunately, this fails in NixOS's default configuration because
/nix/store is a bind mount, so "ln" will fail with "Invalid
cross-device link".  It also fails if hard-link restrictions are
enabled, so a workaround is:

  echo 1 > /proc/sys/fs/protected_hardlinks

The solution is to check that all files in $out are owned by the build
user.  This means that innocuous operations like "ln
${pkgs.foo}/some-file $out/" are now rejected, but that already failed
in chroot builds anyway.
Update release notes
Bump version number
Remove outdated file
Refactoring: Split off the non-recursive canonicalisePathMetaData()

Also, change the file mode before changing the owner.  This prevents a
slight time window in which a setuid binary would be setuid root.
Handle hard links to other files in the output
Bump version number
Handle symlinks properly

Now it's really brown paper bag time...
Update release notes

Also use a point release version number as suggested by several
people.
Handle systems without lutimes() or lchown()
Prevent config.h from being clobbered
Fix annoying Perl 5.16 warnings

I.e.

Subroutine Nix::Store::isValidPath redefined at /nix/store/clfzsf6gi7qh5i9c0vks1ifjam47rijn-perl-5.16.2/lib/perl5/5.16.2/XSLoader.pm line 92.

and so on.
Revert "Prevent config.h from being clobbered"

This reverts commit 28bba8c44f484eae38e8a15dcec73cfa999156f6.
Prevent config.h from being clobbered