(PUP-1737) Ensure mask specific works when other items flag rights

Prior to this if the mask specific rights included read, write, execute (or
plus those and DELETE for modify), then mask_specific would not be flagged and
it would potentially remove the rights. This ensures the mask_specific rights
are flagged appropriately by checking the remainder of the mask as rights are
assigned.
(PUP-1737) sync_aces return early if should_purge
(maint) comments
(PUP-1737) Updates to init.pp