mkimage: do not create world-readable image

mkimage generates world-readable images by default.
mkimage spawns a genisoimage process through the cpopen package
to do the actual work.
It is of course possible to fix the permissions once the ISO image
is created with a trivial os.chmod() call, but this will leave
open a window opportunity to still exploit the bug.
A more correct and secure way to fix the permissions of the newly
generated image is to setup the umask just before to exec.

The current python-cpopen package lacks a way to set the umask
of the child before to run it, so this patch depends on an enhanced
python-cpopen, temporarily located here:

https://github.com/mojaves/python-cpopen

With this enhanced cpopen, fixing the permissions is trivially made
by passing the correct umask at the ISO image creation.

PatchSet v2:
the cpopen patch has been merged upstream:

https://github.com/ficoos/cpopen/commits/master

PatchSet v3:
* updated vdsm.spec.in and debian.control to require an updated cpopen.

PatchSet v4:
* the minimum required cpopen version is 1.2.3-5

PatchSet v5:
* rebased against master
* make iso image not group-writable
* added explicit permission tests (umask tests alread committed
  in the cpopen package)

Change-Id: I893a1310d9988c52cec9f48dfd17dfa1647da4dc
Bug-Url: https://bugzilla.redhat.com/1034172
Signed-off-by: Francesco Romani <fromani@redhat.com>
Reviewed-on: http://gerrit.ovirt.org/21946
Reviewed-by: Yaniv Bronhaim <ybronhei@redhat.com>
Reviewed-by: Dan Kenigsberg <danken@redhat.com>