Keep libraries under groups of their own, and give modules users in them (hq ADR 0328, issue 567)

ADR 0328 supersedes ADR 0325: shared data is a library with one home, kept usable by
its group rather than by ACL entries. The engine now makes each library's group and
each module's user in its libraries' groups; keeps a library's root and requested
sub-paths in its group with group write and setgid on its home, making missing
sub-paths as the root is; waits for the operator's word before touching a root that
holds data, and on the take act walks it by descriptor (no link, same filesystem,
bounded and resumed, files with other names left); holds the containers of a library
whose disk or mount is not there; and puts the tool runner's account in the group.
The ACL keeping, mask repair and watch are gone; an access is again as before ADR 0325.

internal/apply/plan.go

@@ -112,7 +112,7 @@ func Plan(d *declaration.Declaration, known store.State, origin string) []Step {
 			step.Verb, step.Why = "restore", "no longer declared; the original the mesh wrote over goes back "+
 				"from "+orphan.Kept+", unless the file was changed since the mesh last wrote it"
 		case orphan.Type == string(declaration.TypeAccess) && orphan.User != "" && len(orphan.Groups) > 0:
-			// In takeBackGranted's words (novox/hq ADR 0325 §5: no account is in a group for data).
+			// In takeBackGranted's words (novox/hq ADR 0328 §11: no account is in a group for data but a library's).
 			step.Verb, step.Why = "restore", "no longer declared; the path is left as it is, and "+orphan.User+
 				" leaves "+strings.Join(orphan.Groups, ", ")+", which the mesh put it in, unless another declared "+
 				"resource still asks for it"