Set Mask Correctly for POSIX ACLs

[MRayermannMSFT]

The mask is the upper bound of permissions granted to any entry in the group class. The group class consists of named users and named groups plus the owning group. When a user adds a named user or group to the ACL and grants it permissions, the mask must be updated to include those permissions. This is described in https://www.usenix.org/legacy/publications/library/proceedings/usenix03/tech/freenix03/full_papers/gruenbacher/gruenbacher_html/main.html.

So we need to update the mask every time a named user, named group, or the owning group has a change in permissions.