Keep libraries under groups of their own, and give modules users in them (hq ADR 0328, issue 567)

ADR 0328 supersedes ADR 0325: shared data is a library with one home, kept usable by
its group rather than by ACL entries. The engine now makes each library's group and
each module's user in its libraries' groups; keeps a library's root and requested
sub-paths in its group with group write and setgid on its home, making missing
sub-paths as the root is; waits for the operator's word before touching a root that
holds data, and on the take act walks it by descriptor (no link, same filesystem,
bounded and resumed, files with other names left); holds the containers of a library
whose disk or mount is not there; and puts the tool runner's account in the group.
The ACL keeping, mask repair and watch are gone; an access is again as before ADR 0325.

internal/link/queue.go

@@ -63,7 +63,7 @@ type Queue struct {
 	// link (novox/hq issue 358). Nil answers every such ask with a refusal.
 	JudgeDirectories JudgeDirectoriesFunc
 	// AccessAct judges and runs the take act on an access's folder, asked by the controller on an approved
-	// warrant (novox/hq ADR 0325 §8). Nil answers every such ask with a refusal.
+	// warrant (novox/hq ADR 0328 §7). Nil answers every such ask with a refusal.
 	AccessAct AccessActFunc
 	Say       Announce
 	Timeout   time.Duration