(PUP-2036) Changing owner/group/protect should sync permissions

When changing `owner`, `group`, or `inherit_parent_permissions`, it should set
the permissions up to be synced. Prior to this fix, it would take two runs for
convergence to be correct if the permissions are already deemed to be in sync
prior to actually changing the owner, group or inheritance of the security
descriptor.

This is seen most directly when `purge => true`