Adjust spec for --allow-root

I know file=false is the default, but were that to change at any point,
having this be true could potentially compromise the system's security
if wp-cli was run as root.