provisioners/chef: don't follow symlink when chown