[BuildStream] Files without read permission

[Jim MacArthur <jim macarthur codethink co uk>]

We've stalled on issue #684 and wondered if anyone could offer any 
opinions.

https://gitlab.com/BuildStream/buildstream/issues/684 refers to the 
problem of unreadable files being present in the sandbox, which prevents 
us moving files into CAS (we must be able to read them in order to 
produce the hash).

https://gitlab.com/BuildStream/buildstream/merge_requests/837 attempted 
to fix this but it's not safe. As Jürg mentions in his comment on that, 
we might be able to require that source plugins produce only readable 
files. However, it's not unimaginable that we might find a package which 
relies on unreadable files being present. Is there a safe point at which 
we can change the permissions on such a file?

Jim