FCPPluginMessage: Fix bugs and insecurity of "permissions" field

- It would always be null for intra-node messages because I forgot to
add computation for that case
- It could be set by the sender of the message, which is a design
failure. Now the FCPPluginClient (= the deliverer) sets it immediately
before delivery.
- Also, the FCPPluginMessage object is cloned to prevent the caller from
changing the permissions after sending it. Notice that this is overkill
for the current implementation: It only applies to intra-node messages
but we don't support restricting permissions for intra-node messages
yet. But it might be possible that we once do add permissions
levels for that, and its better to prepare the code to not break then.
We don't clone the SimpleFieldSet/Bucket, so the overhead should be OK.