Only mirror permissions to state-root if needed

When mirroring permissions, only adjust the permissions if they do not
already match.  This is to prevent chmod, chown and chgrp errors.
Refactor state-root script into functions
Add :no-deref option to symbolic-link