Reduce permissions changes scope after ADD/COPY

Permissions after an ADD or COPY build instructions are now restricted to the scope of files potentially modified by the operation rather than the entire impacted tree. Besides the reported issue where unnecessary `chown` induced the loss of special permission bits, the previous implementation could trigger unnecessary COW, and thus bloated images (for example: any `ADD` instruction with `/` as destination would trigger [walking and `chown`ing the whole fs](https://github.com/docker/docker/blob/master/builder/internals.go#L678)).

The patch isn't perfect as it may still unnecessarily `chown` previously existing directories "below" the destination, however I do think it remains relevant as it fixes a potentially significant behavior. See [this gist](https://gist.github.com/icecrime/958bc7ef7dc02e36a0a3) for a corner case which still fails: let me know if this sound significant, and if you have any idea for a fix which doesn't imply walking the destination prior to copying.

Fixes #9401.
Fixes #6972