sh.cp_meta: don't apply ACLs with attrs=False