(PUP-1737) Ensure => absent

Simplified removal by flowing through flush - both are just changes whether
adding or removing permissions from an ACL. This does not yet properly report
the change but everything is set up to provide a proper report the changes
(puppet ignores the change report due to ensure => absent meaning at the
moment).
(maint) Ensure || instead of or (control flow)