Reduce permissions changes scope after ADD/COPY

Permissions after an ADD or COPY build instructions are now restricted
to the scope of files potentially modified by the operation rather than
the entire impacted tree.

Fixes #9401.

Signed-off-by: Arnaud Porterie <arnaud.porterie@docker.com>