Make the content of /etc/skel non-world-readable.

Otherwise, such files may be copied to /home/amnesia, and in turn to the
persistent volume, with unsafe permissions. That's no big deal in /home/amnesia
(that is itself not world-readable), *but* the root of the persistent volume has
to be world-readable.
Drop chmod that we're overriding later in config/chroot_local-hooks/99-permissions.
Have activate_custom_mounts create new directories with safe permissions.

This is the second part of the fix for #7443.
Set strict permissions on /home/amnesia (Closes: #7463)
Fix permissions on persistent directories that were created with unsafe permissions (Closes: #7458).
Automatically test persistent directories permissions (Closes: #7560)

These are primarily regression tests to prevent #7443 from coming back.
At the same time, we're testing the migration code that addresses #7458.
Fix step name in Cucumber feature.
Fix expected permissions on persistent directories.
Remove files as the parent directory's owner.

Else, it can't possibly succeed.
The nm-system-connections directory is expected to have mode 755.
Fix name of the persistent CUPS directory.
The CUPS configuration directory also is expected to have mode 755.
Merge branch 'bugfix/7443-persistent-files-permission' into experimental
Set the Unsafe Browser's red theme in the profile that's actually used.
Merge branch 'bugfix/7473-unsafe-browser-theme' into experimental