PUP-1988 Remove permissions should log

This started out as a way to ensure permissions changes would log 
when `ensure=>absent` and ended with removing ensurable with 
`purge=>listed_permissions` instead to remove permissions.