(PUP-1737) rights => ['mask_specific'] improvements

When rights=> ['mask specific'] ensure that mask is also specified and that
rights do not include anything other than 'mask_specific'. If either is not
found to be true, throw an error. In most cases this is likely due to the user
believing they can combine mask_specific with other rights and that is not
the case. mask_specific is mutually exclusive and if rights are applied without
the mask, then erroneous behavior could occur. That is why it is preferable to
throw an error and stop instead of possibly setting permissions in an
unusable state. This is the opposite of including full or modify with other
permissions. In those cases it just removes the other permissions and logs a
warning.