mkimage: create files with explicit permissions

The files in the ISO image created with mkimage.mkIsoFs,
most notably `user_data` and `meta_data.json`, will
have world readable permissions.
They contain sensitive data, so it is unsafe to do so.

This patch addresses the issue by adding the capability to set
per-file permissions at creation time in
mkimage._decodeFilesIntoDir
the current default is 0o640, so we just avoid to create any
world-readable file at all.

Another approach to obtain the same result could be to use
the -file-mode option of the `genisoimage` program.

Fixing the permissions directly into the python code has the following
advantages:

* we use the correct permissions right from the start, effectively
  closing the vulnerability window; if we let genisoimage fix things,
  there still is a (very short) time window on which the newly
  created files are still world-readable.

* this paves the road to fine-grained, per-file permissions
  with negligibile extra cost (in short, this is more forward-compatible).

However, we still need to change to behaviour of `genisoimage` because
it now uses the `-r` option to smartly fix permissions and POSIX
attributes in a meaningful way. Now we need to preserve verbatim the
attributes. The biggest (only?) effect is that genisoimage
no longer automatically fixes uid/gid of the content of the ISO image
to 0/0, and preserves the creator process values.

PatchSet V2:
- removed defaults in _openFile: not needed.
- more complete permissions test: check user and group permissions.

Change-Id: I880143d80c863820aa3a063a6ad8e12fad7e7c42
Bug-Url: https://bugzilla.redhat.com/1034247
Signed-off-by: Francesco Romani <fromani@redhat.com>
Reviewed-on: http://gerrit.ovirt.org/21965
Reviewed-by: Yaniv Bronhaim <ybronhei@redhat.com>
Reviewed-by: Dan Kenigsberg <danken@redhat.com>