Add the ability to tag the file to prevent purges from a managed dir.

The $ensure option makes it easy to tag the file, but avoid setting a
mode.

Thanks to eblake for confirming the behaviour for POSIX. If you're not
POSIX compatible, then this won't break, but we don't care about your
filesystem anyways.