Shell permission checks that allow group write must also check POSIX ACLs

If a launcher refuses to source a file unless it and its parents are private (find -perm -020/-002, ! -user), and you relax that to allow g+w when the group is the user private group (Debian user-group-modes style), Linux POSIX ACLs bypass it. With an ACL, the mode group bits are the ACL mask, so a named entry (setfacl -m u:other:rwx or g:somegroup:rwx, or a default ACL on HOME) shows as 775 with a +. The strict -perm -020 check rejected these as a side effect; the relaxed one accepts them and lets the grantee rename a parent and plant the sourced file. Verified on RHEL xfs: strict PLAIN, relaxed HOOKED. Fixes: avoid needing the relaxation (create the whole chain under umask 077), or allow g+w only when getfacl -s prints nothing or ls -ld shows no +. Also, getent group <gid> cannot see primary-group members or duplicate-GID entries, and sssd usually does not enumerate getent passwd.